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ehain  is  the  laek  of  a  method  of  evaluating  existing  levels  of  risk  based  upon  points  of 
origin,  points  of  departure  and  eargo  and  aireraft  type.  This  is  partieularly  challenging 
sinee  the  eurrent  United  States  air  eargo  seeurity  protoeol  requires  the  100  pereent 
sereening  of  all  air  eargo  without  objeetively  analyzing  or  evaluating  the  risk  posed  by 
the  air  eargo. 

This  thesis  proposes  a  risk-based  intelligenee  driven  approaeh  to  identify  and 
mitigate  the  threat  of  the  sueeessful  introduetion  of  an  improvised  explosive  deviee  into 
the  international  air  eargo  supply  ehain.  The  primary  thrust  of  this  researeh  effort  is  to 
eonduet  a  eomparative  analysis  of  the  United  States  international  air  eargo  polieies  and 
the  European  Union’s  international  air  eargo  polieies  as  a  means  of  evaluating  and 
proposing  a  risk  based  intelligenee  driven  international  air  eargo  poliey  that  eapitalizes  on 
the  strengths  of  United  States  and  European  Union’s  systems. 
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EXECUTIVE  SUMMARY 


A.  INTRODUCTION 

As  noted  in  numerous  government  and  industry  reports,  the  eurrent  international 
application  of  the  congressionally  mandated  100  percent  air  cargo  screening  requirement 
is  currently  unattainable.  A  portion  of  the  problem  with  the  implementation  of  the 
mandate  is  the  inability  of  the  Transportation  Security  Administrations  (TSA)  to  enforce 
air  cargo  screening  requirements  beyond  the  U.S.  territorial  borders.  Additionally,  if  the 
jurisdictional  authority  existed,  the  infrastructure  necessary  to  meet  the  100  percent 
security  screening  requirements  as  required  by  the  Aviation  Transportation  Security  Act 
(ATSA)  simply  does  not  exist  within  the  international  air  cargo  supply  chain.  The 
administration’s  regulatory  capabilities,  while  sufficient  for  domestic  enforcement,  fall 
short  of  what  would  be  required  to  enforce  administrative  screening  requirements  in 
foreign  nations. 

To  that  end,  in  March  2012,  Customs  and  Border  Protection  (CBP)  and  the  TSA 
created  a  pilot  program  known  as  the  Air  Cargo  Advanced  Screening  (ACAS)  program 
with  the  intent  of  leveraging  the  capabilities  of  each  agency.  i  The  goal  of  this  pilot 
program  was  to  streamline  the  processes  and  procedures  for  the  advanced  screening  of 
international  air  cargo  through  the  collection  and  analysis  of  shipping  and  shipper  data. 
The  objective  of  this  data  collection  was  to  create  a  “trusted  shipper”  and  “trusted 
shipment”  system  that  could  be  combined  with  the  information  available  in  CBP’s 
automated  targeting  system.  While  this  process  provides  an  opportunity  for  CBP  and  the 
TSA  to  ensure  shippers  have  been  vetted  prior  to  providing  cargo  for  shipment  by 
aircraft,  it  does  not  allow  the  TSA  or  CBP  to  establish  effectively  the  level  of  risk  the 
cargo  or  its  point  of  origin  may  present  to  the  aircraft.2  While  these  programs  and 
administrative  advances  are  beneficial,  the  failure  to  apply  a  risk-based  and  intelligence 


1  U.S.  Customs  and  Border  Patrol  Transportation  Security  Administration,  Air  Cargo  Advanced 
Screening  Pilot  Strategic  Plan,  March  2012. 

2  Ibid. 
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driven  protocol  designed  to  target  shippers,  shipments,  points  of  origin,  and  regions  that 
pose  the  greatest  threat  to  air  cargo  still  needs  to  be  addressed. 


B,  PROBLEM  STATEMENT 

Exploring  the  issues  surrounding  international  air  cargo  security  is  as  important  as 
ever.  The  cost  of  a  successful  attack  on  the  commercial  aviation  system  that  results  in  a 
seven-day  shutdown  of  commercial  aviation  would  be  between  $248  billion  to  $394 
billion  during  the  two-year  recovery  period  resulting  from  the  attack,  according  to  the 
Center  for  Risk  and  Economic  Analysis  of  Terrorism  Events  at  the  University  of 
California.  Eor  the  past  three  decades,  terrorists  have  actively  attempted  to  exploit 
weaknesses  in  the  aviation  industry  as  a  means  of  weakening  the  U.S.  economy  and 
causing  fear  in  society.  Specifically,  terrorist  organizations  have  regularly  targeted  U.S. 
citizens  and  its  economy  by  attempting  to  detonate  explosive  devices  on  passenger  and 
cargo  aircraft.  As  quoted  in  the  November  2010  special  edition  of  Inspire  magazine,  and 
reported  by  A1  Jazeera,  A1  Qaeda  stated,  “We  are  laying  out  for  our  enemies’  our  plan  in 
advance  because  as  we  stated  earlier  our  objective  is  not  maximum  kill,  but  to  cause 
[damage]  in  the  aviation  industry,  an  industry  that  is  so  vital  for  trade  and  transportation 
between  the  US  and  Europe.”  These  attacks  and  attempted  attacks  have  regularly 
involved  the  use  of  improvised  explosive  devices  (lEDs).  In  an  analysis  conducted  by  the 
Homeland  Security  News  Wire  after  the  Boston  Marathon  bombings,  it  was  determined 
by  START  “that  lEDs  were  the  most  common  weapons  used  in  the  207  terrorist  plots  and 
attacks  in  the  United  States  from  2001  to  2011.”  In  the  past  three  decades,  terrorists  have 
sought  to  disrupt  the  U.S.  economy  by  attacking  aviation.  While  the  most  successful  of 
these  attacks  involved  hijacking,  the  most  consistent  means  of  attack  involved  the 
attempted  detonation  of  lEDs  on  aircraft. 

As  policies  and  technologies  were  introduced  to  counter  the  lED  threat,  terrorists 
have  shifted  the  means  of  introducing  an  lED  onto  an  aircraft.  They  have  now  focused  on 
the  vulnerabilities  that  exist  in  the  air  cargo  environment.  Prior  to  the  attacks  that 
occurred  on  September  11,  2001,  the  Eederal  Aviation  Administration  (EAA)  was 
responsible  for  aviation  security  and  had  implemented  a  number  of  recommendations. 
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mandates,  and  security  directives  to  improve  modern  aviation  security  starting  in  1990. 
After  each  of  these  attacks,  the  FAA  and  now  the  Transportation  Security  Administration 
(TSA)  attempted  to  institute  security  directives  that  would  detect,  deter,  or  prevent  future 
attacks.  Existing  regulations,  policies,  and  procedures  were  reviewed  and  amended  to 
meet  the  evolving  threat.  In  certain  instances.  Congress  stepped  in  and  passed  legislation 
designed  to  close  real  and  perceived  gaps  in  aviation  security.  One  of  these  legislative 
solutions  was  the  100  percent  air  cargo-screening  requirement,  which  was  passed  in 
2007.  In  each  instance,  the  improved  processes  failed  to  detect  or  prevent  the  future 
attacks. 


C.  RESEARCH  QUESTIONS 

The  primary  question  this  thesis  addressed  is  can  a  multi-layered,  intelligence- 
driven  air  cargo  security  protocol  be  developed  from  existing  programs  to  decrease  the 
threat  posed  by  a  cargo-borne  incendiary  device  or  lED? 

In  addition,  this  thesis  considered  the  following  questions.  How  can  the  TSA  in 
collaboration  with  CBP  better  apply  risk  categories  to  the  international  air  cargo 
screening  requirements  to  decrease  the  probability  of  a  successful  terrorist  attack  on  air 
cargo?  Which  programs  are  suited  to  this  collaboration,  which  systems  create 
unnecessary  redundancies,  and  do  new  programs  need  to  be  established? 

This  thesis  attempted  to  confirm  the  following  suppositions. 

•  A  risk-based  international  air  cargo  screening  protocol  provides  the 
flexibility  necessary  to  adjust  to  the  changing  threats  and  the  technological 
advancements  in  the  air  cargo  industry. 

•  A  risk-based  international  air  cargo  screening  protocol  will  provide  the 
adaptability  necessary  to  adjust  to  the  threat  environment  based  on  the 
associated  risks  rather  than  treating  all  threat  environments  as  equal. 

•  A  risk-based  international  air  cargo  screening  protocol  will  provide  a 
sustainable  security  process  while  simultaneously  meeting  the  needs  of  the 
air  cargo  industry. 

D,  ANALYSIS 

A  comparative  analysis  of  the  processes  and  producers  applied  by  the  European 
Union  (EU)  was  conducted  to  evaluate  the  practicality  of  using  a  risk-based  intelligence 
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driven  air  cargo  security  screening  process  that  accounts  for  differences  in  vulnerabilities 
while  additionally  creating  a  universal  framework  that  can  be  applied  over  several 
differing  jurisdictions.  To  this  point,  the  requirements  imposed  by  the  European  upon  the 
member  states  are  not  dissimilar  from  those  that  the  TSA  imposes  on  known  shippers  in 
the  United  States.  The  polices  of  the  European  Union  and  the  United  States  diverge  when 
risk  and  consequence  are  inserted  into  the  security  equation  by  the  European  Union  as  a 
means  of  mitigating  risk.  The  application  of  a  risk  and  consequence-based  security 
protocol,  as  seen  in  the  EU  application  of  varying  security  requirements  dependent  of 
class  of  aircraft,  is  in  direct  conflict  with  the  regulatory  requirement  imposed  on  the  TSA 
by  the  congressionally  mandated  100  percent  air  cargo  screening  process. 

E,  RECOMMENDATIONS 

This  thesis  makes  the  following  recommendations  and  assertions. 

•  A  risk-based  intelligence  driven  process  for  the  screening  of  international 
air  cargo  should  be  developed  and  implemented  for  application  prior  to  the 
introduction  of  air  cargo  into  the  global  supply  chain.  This  process  would 
be  designed  with  the  intention  of  enhancing  air  cargo  security  without 
overwhelming  the  aviation  industry  with  unrealistic  goals  and 
expectations. 

•  A  risk  assessment  methodology  would  be  applied  to  air  cargo  and  mail 
security  that  recognizes  that  different  portions  of  the  supply  chain  are 
subject  to  varying  security  strengths  and  vulnerabilities,  and  as  such,  do 
not  represent  an  equal  levels  of  risk. 

•  The  current  100  percent  air  cargo  security  screening  process  fails  to 
recognize  these  differences,  and  is  both  cumbersome  to  the  industry,  and 
an  inefficient  use  of  valuable  security  and  law  enforcement  resources. 
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I.  INTRODUCTION 


A.  PROBLEM  SPACE 

Exploring  the  issues  surrounding  international  air  cargo  security  is  as  important  as 
ever.  The  cost  of  a  successful  attack  on  the  commercial  aviation  system  that  results  in  a 
seven-day  shutdown  of  commercial  aviation  would  be  between  $248  billion  to  $394 
billion  during  the  two-year  recovery  period  resulting  from  the  attack,  according  to  the 
Center  for  Risk  and  Economic  Analysis  of  Terrorism  Events  at  the  University  of 
California.!  Eor  the  past  three  decades,  terrorists  have  actively  attempted  to  exploit 
weaknesses  in  the  aviation  industry  as  a  means  of  weakening  the  United  States  economy 
and  causing  fear  in  society.  Specifically,  terrorist  organizations  have  regularly  targeted 
U.S.  citizens  and  its  economy  using  explosive  devices  on  passenger  and  cargo  aircraft.  As 
quoted  in  the  November  2010  special  edition  of  Inspire  magazine  and  reported  by  A1 
Jazeera,  A1  Qaeda  stated,  “We  are  laying  out  for  our  enemies’  our  plan  in  advance 
because  as  we  stated  earlier  our  objective  is  not  maximum  kill,  but  to  cause  [damage]  in 
the  aviation  industry,  an  industry  that  is  so  vital  for  trade  and  transportation  between  the 
US  and  Europe. ”2  These  attacks  and  attempted  attacks  have  regularly  involved  the  use  of 
improvised  explosive  devices  (lEDs).  In  an  analysis  conducted  by  the  Homeland  Security 
News  Wire  after  the  Boston  Marathon  bombings,  it  was  determined  by  START  “that 
lEDs  were  the  most  common  weapons  used  in  the  207  terrorist  plots  and  attacks  in  the 
United  States  from  2001  to  2011. ”3  In  the  past  three  decades,  terrorist  have  sought  to 
disrupt  the  U.S.  economy  by  attacking  aviation.  While  the  most  successful  of  these 
attacks  involved  hijacking,  the  most  consistent  means  of  attack  involved  the  attempted 
detonation  of  lEDs  on  aircraft. 


!  Peter  Gordon,  “The  Eeonomie  Impaets  of  a  Terrorist  Attaek  on  the  U.S.  Commereial  Aviation 
System,”  Create  Homeland  Security  Center  at  the  University  of  Southern  California,  Oetober  1,  2005, 
http://ereate.use.edu/researeh/50796.pdf 

2  ALJAZEERA,  “Al-Qaeda  Wing  to  Target  US  Eeonomy,”  November  21,  2010,  http://www.aljazeera. 
eom/news/middleeast/2010/1 1/20101 121 10484673847.html. 

2  Homeland  Seeurity  News  Wire,  “lEDs  Growing  Threat  in  U.S.,  Seeurity  Experts,”  April  17,  2013 
http://www.homelandseeuritynewswire.eom/dr20130417-ieds-a-growing-threat-in-u-s-seeurity-experts. 
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•  On  12  December  1988,  an  explosive  device  was  placed  on  Pan  American 
flight  103,  which  detonated  in  the  cargo  hold  and  caused  a  terminal  failure 
of  the  aircraft  structure.  The  attack  succeeded  in  killing  243  passengers,  16 
crew  members  and  11  residents  of  Lockerbie  Scotland  where  large 
sections  of  the  fuselage  landed.  ^ 

•  On  22  January  1995,  Ramsey  Yousef  conspired  to  place  explosives  on  10 
American  flagged  commercial  passenger  aircraft  bound  for  North  America 
with  the  intent  of  causing  simultaneous  catastrophic  airframe  failures  over 
the  Pacific  Ocean.  ^ 

•  On  22  December  2001,  Richard  Reid  attempted  to  detonate  an  explosive 
device  hidden  in  his  shoe  on  American  Airlines  flight  63  while  over  the 
Atlantic  Ocean. ^ 

•  On  24  August  2004,  Satsita  Dzhebirkhanova  and  Amanta  Nagayeva 
successfully  detonated  concealed  lEDs  on  two  separate  aircraft  in  a 
coordinated  attack  that  killed  90  people.^ 

•  On  24  December  2009,  Farouk  Abdulmutallab  attempted  to  detonate  an 
lED  secreted  in  his  underwear  on  Northwest  flight  253  while  over  the 
United  States.^ 

•  On  3  September  2010,  Al-Qaeda  in  the  Arabian  Peninsula  claimed 
responsibility  for  a  attack  on  a  Boeing  747-44AF  (SCD)  cargo  plane, 
registered  N571UP,  which  was  destroyed  in  an  accident  shortly  after 
takeoff  from  Dubai  Airport  (DXB),  UAE.  Both  crewmembers  were  killed 
in  the  crash.  9 

•  On  29  October  2010,  Al-Qaeda  in  the  Arabian  Peninsula  (AQAP)  shipped 
two  explosive  devices  by  aircraft,  which  were  discovered  in  separate  cargo 
aircraft  bound  for  the  United  States.  These  explosives  were  set  to  explode 
while  in  flight  over  the  United  States, 


Washington  Post,  “The  Bombing  of  Pan  Am  Flight  103,”  1999,  http://www.washingtonpost 
.com/wp-srv/inatFlongterm/panaml03/timeline.htm. 

^  CNN,  “Plane  Terror  Suspeets  Convieted  on  All  Counts,”  September  5,  1996,  http://www.enn.eom/ 
US/9609/05/terror.plot/. 

^  CNN,  “Exehange  Between  Reid  Judge,  Follows  Life  Sentenee,”  Deeember  6,  2003,  http://www.enn. 
eom/2003/LAW/01/30/shoebomber.senteneing/. 

^  Assoeiated  Press,  “Russia  Plane  Crashes  Caused  by  Explosives,”  August  30,  2004,  http://www.nbe 
news.eom/id/5810127/ns/world_news/t/russia-plane-erashes-eaused-explosives/#.UlBkZRaPCZY. 

^  David  Ariosto  and  Deborah  Feyeriek,  “Christmas  Day  Bomber  Senteneed  to  Life  in  Prison,”  CNN, 
February  17,  2012,  http://www.enn.eom/2012/02/16/justiee/miehigan-underwear-bomber-senteneing. 

9  ALJAZEERA,  “Al-Qaeda  Wing  to  Target  US  Eeonomy.” 

The  Telegraph,  “Ink  Cartridge  Bomb  Reveals  Innovation  of  Terrorist  Group,”  Oetober  30,  2010, 
http://www.telegraph.eo.uk/news/uknews/terrorism-in-the-uk/8098587/lnk-eartridge-bomb-reveals- 
innovation-of-terrorist-groups.html. 
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As  policies  and  technologies  were  introduced  to  counter  the  lED  threat,  terrorists 
have  shifted  the  means  of  introducing  an  lED  onto  an  aircraft.  They  now  focus  on  the 
vulnerabilities  that  exist  in  the  air  cargo  environment.  Prior  to  the  attacks  that  occurred  on 
September  11,  2001,  the  Eederal  Aviation  Administration  (EAA)  was  responsible  for 
aviation  security  and  had  implemented  a  number  of  recommendations,  mandates,  and 
security  directives  to  improve  modern  aviation  security  starting  in  1990.  After  each  of 
these  attacks,  the  EAA  and  now  the  Transportation  Security  Administration  (TSA) 
attempted  to  institute  security  directives  that  would  detect  or  prevent  future  attacks. 
Existing  regulations,  policies,  and  procedures  were  reviewed  and  amended  to  meet  the 
evolving  threat.  In  certain  instances.  Congress  stepped  in  and  passed  legislation  designed 
to  close  real  and  perceived  gaps  in  aviation  security.  One  of  these  legislative  solutions 
was  the  100  percent  air  cargo-screening  requirement,  which  was  passed  in  2007.  In  each 
instance,  the  improved  processes  failed  to  detect  or  prevent  the  future  attacks. 

While  airport  passenger  screening  is  the  sole  responsibility  of  the  TSA,  aviation 
cargo  screening  is  a  fractured  system  that  involves  the  TSA,  Customs  and  Border 
Protection  (CBP),  private  corporations,  freight  forwarders,  and  shippers.  These  diverse 
stakeholders,  each  of  who  have  separate  goals  that  are  not  complementary — industry 
seeking  profit  and  government  seeking  regulation — create  vulnerabilities  that  continue  to 
present  aviation  security  challenges.  Industry  in  the  form  of  the  aviation  industry,  freight 
forwarders,  and  shippers  seek  the  most  efficient  and  cost  effective  means  of  delivering 
products.  Government,  which  is  represented  by  the  TSA  and  CBP,  are  focused  on 
preventing  successful  attacks  on  this  nation’s  aviation  industry  with  little  regard  for  the 
security  measures’  costs  or  the  burdens  placed  on  industry.  David  Widdowson  and 
Stephen  Holloway  stated  in  a  World  Customs  Journal  article  about  transport  security 
regulation,  “many  government  responses  to  the  international  security  threat  merely  lead 
to  an  increase  in  the  regulatory  burden  on  honest  traders”  without  enhancing  the  security 


U.S.  Government  Accountability  Office,  Report  to  Congressional  Requesters,  Aviation  Security, 
Vulnerabilities  and  Potential  Improvements  for  the  Air  Cargo  System  (GAO-03-344),  Washington,  DC: 
GPO,  2002,  http://www.gao.gOv/products/GAO-03-344. 
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of  high-risk  shipments.  This  vulnerability  is  further  exaeerbated  by  the  inability  of  the 
TSA  and  CBP  to  regulate  international  air  eargo  bound  for  the  United  States.  This 
vulnerability  was  highlighted  in  Congressional  testimony  when  Pennsylvanian 
Congressman  Charles  Dent  stated  in  his  2010  testimony  before  the  Committee  on 
Homeland  Seeurity  that  “TSA  has  no  elear  plan  in  plaee  to  address  foreign  in-bound 
eargo,  thought  the  law  requires  it.  Why  is  that?  Not  for  a  lack  of  effort,  but  because  of  a 
lack  of  authority. ”13  The  current  international  air  cargo  screening  processes  are 
reminiscent  of  those  that  existed  in  the  airport  passenger-screening  environment  prior  to 
September  11,  2001.  The  system  relies  on  the  industry  acceptance,  third-party  contractor 
application,  and  regulatory  enforcement  to  ensure  the  appropriate  screening  procedures 
are  applied. 

The  TSA  through  the  Aviation  Transportation  Security  Act  (ATSA)  is  tasked  with 
regulating  the  screening  of  passengers  and  cargo,  This  requirement  is  further  codified 
in  49  CFR  Part  1542- Airport  Security,  which  outlines  the  regulatory  relationship 
between  the  TSA  and  airport  operators,  Cargo  operations  are  regulated  under  49  CFR 
Part  1544.205-Acceptance  and  Screening  of  Cargo,  which  states  that  aircraft  operators 
are  responsible  for  preventing  the  carriage  of  explosives  in  cargo  onboard  aircraft  and 
how  this  should  be  accomplished.!^  It  is  this  ambiguous  screening  requirement,  which  is 
further  defined  in  49  CFR  Part  1548-Indirect  Air  Carrier  Security,  that  creates  the 


12  David  Widdowson  and  Stephen  Holloway,  “Maritime  Transport  Seeurity  Regulation:  Polieies, 
Probabilities  and  Praetiealities,”  World  Customs  Journal  3,  no.  2  (2009),  http://www.intemationaltrans 
portfomm.  org/2009/ forum2009 .  html. 

13  Charles  Dent,  “100  Pereent  Air  Cargo  Sereening:  Remaining  Steps  to  Seeure  Passenger  Aireraft, 
Hearing  before  the  Subeommittee  on  Transportation  Security  and  Infrastructure  Protection,”  2010, 
http://www.gpo.gov/fdsys/pkg/CHRG-l  1  ll^rg64699/html/CHRG-l  1  lhhrg64699.htm. 

I'l  Govytrack.us.,  “S.  1447  (107th):  Aviation  and  Transportation  Security  Act,”  2001,  http://www. 
govtrack.us/congress/bills/ 1 07/s  1 447. 

13  U.S.  Government  Printing  Office,  “49  CFR  Part  1542-Airport  Security,”  2010,  http://www.gpo. 
gov/fdsys/granule/CFR-2010-title49-vol9/CFR-2010-title49-vol9-partl542/content-detail.html. 

m  U.S.  Government  Printing  Office,  “49  CFR  Part  1544.205-Aircraft  Operator  Security:  Air  Carriers 
and  Commercial  Operators,”  2010,  http://www.gpo.gOv/fdsys/granule/CFR-2010-title49-vol9/CFR-2010- 
title49-vol9-partl544/content-detail.html. 
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greatest  vulnerability  in  air  eargo  operations  by  allowing  89  independent  eargo  sereening 
facilities  to  certify  the  safety  of  air  cargo  while  remaining  subject  to  inspection  by 
approximately  400  transportation  security  inspectors.!^ 

Since  its  creation,  the  TSA  has  mandated  increased  industry  security  measures 
around  cargo  facilities  and  aircraft  through  the  use  of  security  directives  that  target  these 
vulnerable  assets.  As  an  example,  Transportation  Security  Inspectors  (TSI)  have 
increased  cargo  inspections,  explosive  detection  canine  teams  have  been  added  at  airport 
cargo  facilities,  and  training  programs  for  air  cargo  workers  have  been  created.!*  The 
TSA  has  additionally  moved  beyond  the  airport  cargo  preparation  and  receiving  areas  and 
is  currently  using  over  1,200  facilities  located  outside  airport  properties  for  industry- 
supported  cargo  screening  through  the  Certified  Cargo  Screening  Program  (CCSP).!^ 

The  Administration’s  regulatory  capabilities,  while  sufficient  for  domestic 
enforcement,  fall  short  of  what  would  be  required  to  enforce  administrative  screening 
requirements  in  foreign  nations  because  of  an  inability  of  the  Administration  to  enforce 
these  requirements  effectively  in  the  international  arena.  This  inability  makes 
implementing  and  regulating  the  100  percent  air  cargo-screening  requirement 
problematic  outside  the  U.S.  jurisdictional  boundaries.  This  weakness,  which  is  shared  by 
CBP,  has  been  exploited  by  narcotics,  human,  and  counterfeit  merchandise  smugglers, 
and  remains  the  weakest  link  in  the  air  cargo  transportation  chain.  The  TSA  and  CBP 
continue  to  seek  administrative  solutions  to  air  cargo  screening  problems  that  reach 
beyond  the  authority  granted  to  the  administration. 


!^  U.S.  Government  Printing  Office,  “49  CFR  Part  1548-Indirect  Air  Carrier  Security,”  2002, 
http://www.ecff. gov/cgi-bin/text-idx?c=ecfr;sid=c60b3377d4eaafad4feeec6cd8f29983;rgn=div5;view= 
text;node=49  percent3A9.1.3.5.13;idno=49;cc=ecfr. 

!*  Transportation  Security  Administration,  “Kip  Hawley  Assistant  Secretary,  Transportation  Security 
Administration;  Testimony  to  the  Subcommittee  on  Homeland  Security  Committee  on  Appropriations,” 
2008,  http://www.tsa.gov/press/speeches/testimony_archives.shtm. 

!!!  Transportation  Security  Administration,  “Certified  Cargo  Screening  Program,”  n.d.,  http://www. 
tsa.gov/certified-cargo-screening-program. 
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To  that  end,  in  March  2012,  CBP  and  the  TSA  created  a  pilot  program  known  as 
the  Air  Cargo  Advanced  Screening  (ACAS)  program  with  the  intent  of  leveraging  the 
capabilities  of  each  agency. 20  The  goal  of  this  pilot  program  was  to  streamline  the 
processes  and  procedures  for  the  advanced  screening  of  international  air  cargo  using  data 
collection.  The  objective  of  this  data  collection  was  to  create  a  “trusted  shipper”  and 
“trusted  shipment”  system  that  could  be  combined  with  the  data  available  in  CBP’s 
automated  targeting  system.  While  this  process  provides  an  opportunity  for  CBP  and  the 
TSA  to  ensure  shippers  have  been  vetted  prior  to  providing  cargo  for  shipment  by 
aircraft,  it  does  not  allow  the  TSA  or  CBP  to  establish  effectively  the  level  of  risk  the 
cargo  or  its  point  of  origin  may  present  to  the  aircraft.21  While  these  programs  and 
administrative  advances  are  beneficial,  the  failure  to  apply  a  risk-based  and  intelligence 
driven  protocol  designed  to  target  shippers,  shipments,  points  of  origin,  and  regions  that 
pose  the  greatest  threat  to  air  cargo  still  needs  to  be  addressed.  As  noted  by  the 
Government  Accountability  Office  (GAO)  in  20 1 1 ,  “TSA  currently  uses  a  risk  informed 
approach  to  schedule  foreign  airport  assessments  by  categorizing  airports  into  three 
tiers. ”22  These  tiers  would  additionally  be  utilized  to  identify  air  cargo  shippers  and 
shipments  that  should  be  the  emphasis  of  the  ACAS  system  to  ensure  the  most  efficient 
use  of  the  limited  security  resources. 

As  previously  noted,  the  exceptional  economic  cost  of  a  successful  attack  on 
aviation  makes  these  assets  an  attractive  target  for  terrorists.  Additionally,  the  fact  that  by 
2008  counter-terrorism  spending  had  increased  by  $15  billion  over  conventional  counter 
threat  spending  on  all  other  crime  and  the  economic  impact  this  spending  has  on  the 
United  States,  should  not  be  ignored.  23  This  type  of  impact  is  precisely  what  A1  Qaeda 
seeks.  To  this  point,  A1  Qaeda  stated  in  November  2010  in  the  third  edition  of  Inspire 

20  U.S.  Customs  and  Border  Patrol  Transportation  Security  Administration,  Air  Cargo  Advanced 
Screening  Pilot  Strategic  Plan,  March  2012. 

21  Ibid. 

22  U.S.  Government  Accountability  Office,  Aviation  Security;  TSA  Has  Taken  Steps  To  Enhance  Its 
Foreign  Airport  Assessments,  but  Opportunities  Exist  to  Strengthen  the  Program  (GAO-12-163), 
Washington,  DC:  GPO,  2011. 

23  Veronique  de  Rugy,  “The  Economics  of  Homeland  Security,”  in  Terrorizing  Ourselves:  Why  U.S. 
Counterterrorism  Policy  Is  Failing  and  How  to  Fix  It,  ed.  Benjamin  H.  Friedman,  Jim  Harper,  and 
Christopher  A.  Preble  (Washington,  DC:  Cato  Institute,  2010),  123. 
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magazine,  “In  terms  of  time  it  took  us  three  months  to  plan  and  exeeute  the  operation 
from  beginning  to  end.  On  the  other  hand  this  supposedly  ‘foiled  plot’,  as  some  of  our 
enemies  would  like  to  eall  it,  will  without  a  doubt  eost  America  and  other  Western 
countries  billions  of  dollars  in  new  security  measures. ”24  In  the  years  following  the 
attacks  on  9/1 1  TSA  implemented  a  layered  approach  to  aviation  security,  which  includes 
21  different  layers  depicted  below  that  were  designed  to  detect  and  deter  a  successful 
terrorist  attack  on  an  aircraft. 


Layers  of  U.S.  Aviation  Security 


Figure  1.  Layers  of  U.S.  Aviation  Security's 


In  the  II  years  since  the  attacks  of  September  II,  2001,  private  industry,  the 
FAA,  and  the  TSA  have  attempted  to  procure  a  technological  or  develop  a  regulatory 
solution  to  the  threat  of  an  lED  on  an  airplane.  In  his  opening  remarks  to  Congress, 

24  Al-Malaham  Media,  “Special  Issue,”  Inspire  Magazine  no.  3  (November  2010),  http://ia600304.us. 
archive.org/28/items/INSPIRE_ISSUE_3/special.pdf. 

25  Transportation  Security  Administration,  “Layers  of  Security”  n.d.,  http://www.tsa.gov/about- 
tsa/layers-security. 
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Stephen  M.  Lord,  the  Director  of  Homeland  Security  and  Justice  Issues  from  the  GAO, 
stated,  “In  the  almost  10  years  that  have  passed  since  TSA  assumed  responsibility  for 
aviation  security,  TSA  has  spent  billions  of  dollars  and  implemented  a  wide  range  of 
initiatives  to  strengthen  the  layers  of  aviation  security.  However,  risks  to  the  aviation 
system  remain.”26  Numerous  protocols,  regulations,  and  detection  equipment  have  been 
deployed  with  the  intention  of  mitigating  this  threat.  Despite  the  significant  investment  of 
time  and  money,  to  date,  none  of  these  solutions  has  been  completely  successful,  as 
evidenced  by  the  successful  lED  attack  perpetrated  by  AQAP  on  October  28,  2010. 
While  combining  the  capabilities  and  administrative  authorities  of  the  TSA  and  CBP  is  a 
good  start,  the  inability  of  these  agencies  to  capitalize  on  and  leverage  the  data  they 
already  possess  to  improve  the  current  system  by  applying  a  risk-based  intelligence 
driven  air  cargo  protocol  needs  to  be  addressed. 

B,  RESEARCH  QUESTIONS 

The  primary  question  this  thesis  addressed  is,  can  a  multi-layered,  intelligence- 
driven  air  cargo  security  protocol  be  developed  from  existing  programs  to  decrease  the 
threat  posed  by  a  cargo-borne  incendiary  or  lED? 

In  addition,  this  thesis  considered  the  following  questions:  How  can  the  TSA  in 
collaboration  with  CBP  better  apply  risk  categories  to  the  international  air  cargo 
screening  requirements  to  decrease  the  probability  of  a  successful  terrorist  attack  on  air 
cargo?  Which  programs  are  suited  to  this  collaboration;  which  systems  create 
unnecessary  redundancies,  and  do  new  programs  need  to  be  established? 

This  thesis  attempted  to  confirm  the  following  suppositions. 

•  A  risk-based  international  air  cargo  screening  protocol  provides  the 
flexibility  necessary  to  adjust  to  the  changing  threats  and  the  technological 
advancements  in  the  air  cargo  industry. 


U.S.  Government  Accountability  Office,  Testimony  Before  the  Subcommittee  on  National  Security, 
Homeland  Defense,  and  Foreign  Operations,  Committee  on  Oversight  and  Government  Reform,  House  of 
Representatives,  Aviation  Security,  TSA  Has  Taken  Actions  to  Improve  Security,  but  Additional  Efforts 
Remain,  Statement  of  Stephen  M.  Lord,  Director  Homeland  Security  and  Justice  Issues  (GAO- 1 1-807T), 
2011,  http://www.gao.gOv/products/GAO-ll-807T. 


8 


•  A  risk-based  international  air  eargo  sereening  protoeol  will  provide  the 
adaptability  neeessary  to  adjust  to  the  threat  environment  based  on  the 
assoeiated  risks  rather  than  treating  all  threat  environments  as  equal. 

•  A  risk-based  international  air  eargo  sereening  protoeol  will  provide  a 
sustainable  seeurity  proeess  while  simultaneously  meeting  the  needs  of  the 
air  eargo  industry. 

C.  RESEARCH  METHOD 

This  thesis  is  a  poliey  analysis  projeet.  Aeeording  to  Bardaeh,  poliey  analysis 
eontains  eight  steps,  whieh  inelude  defining  the  problem,  assembling  evidenee, 
eonstrueting  alternatives,  and  seleeting  evaluation  eriteria,  projeeting  the  outeomes  and 
eonfronting  the  tradeoffs,  and  determining  the  best  eourse  of  aetion.  This  projeet  is  based 
upon  and  uses  the  methodologieal  framework  established  by  Bardaeh. 27  The  polieies 
being  researehed  and  evaluated  are  the  eongressionally  mandated  100  pereent 
international  air  eargo  sereening  requirement,  the  European  Union  (EU)  regulatory 
framework  as  applied  to  the  implementation  of  EU  regulation  1082/2012Y  in  respeet  to 
aviation  seeurity  validations  and  the  proposed  risk-based  intelligenee  driven  international 
air  eargo  sereening  protoeol.  The  speeifie  aspeets  of  those  poliees  researehed  are  the 
availability  and  reliability  of  data  and  intelligenee,  jurisdietional  hurdles  for 
implementation  and  enforeement,  the  measurement  and  applieation  of  risk,  as  well  as  the 
government  and  industry  ineurred  eost. 

The  eriteria  used  to  analyze  and  develop  reeommendations  for  eaeh  of  these 
poliees  researehed  were  seleeted  after  a  review  of  the  available  industry  and  government 
literature  and  testimony.  The  literature  and  available  industry  and  government  testimony 
determined  the  path  of  the  researeh  as  previous  poliees,  reeommendations,  and  proposed 
solutions  to  the  threat  of  explosives  on  aireraft  were  analyzed  over  the  two  and  a  half 
deeades  preeeding  the  sueeessful  air  eargo  attaek  in  2010. 

The  researeh  was  broken  into  three  seetions.  The  first  seetion  evaluated  the  data 
and  literature  as  it  pertains  to  the  pre-9/1 1  period  of  aviation  seeurity  with  an  emphasis  on 
the  period  after  an  lED  attaek  on  Pan  Am  flight  103.  This  period  of  time  provides  insight 

27  Eugene  Bardaeh,  A  Practical  Guide  for  Policy  Analysis  (Washington,  DC:  CQ  Press  College,  2011). 
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into  the  evolving  threat  of  terrorism  and  terrorist  organizations’  emphasis  on  aviation 
attaeks.  During  this  period,  the  Gore  eommission  and  the  assoeiated  GAO  reports 
identified  many  of  the  jurisdictional  and  cost  challenges  faced  by  the  FAA  for 
implementing  international  aviation  security.  These  challenges  primarily  focused  on  the 
jurisdictional  conflicts,  implementation  costs,  the  unpredictability  of  terrorist  attacks,  and 
the  lack  of  actionable  intelligence.  These  limitations  were  used  as  a  means  of  framing  the 
research  and  served  as  means  of  evaluating  the  practicality  of  implementing  each  of  the 
three  processes.  The  two  consecutive  periods  of  research  included  the  post-9/11  period 
and  the  time  frame  after  the  successful  air  cargo  attack  in  October  2010.  Aviation 
security  was  continuously  evolving  during  each  of  the  periods,  and  the  policies  and 
practices  implemented  were  evaluated.  At  the  conclusion  of  this  policy  evaluation,  a  clear 
understanding  of  the  issues  and  problems  related  to  the  application  of  a  100  percent 
international  air  cargo  screening  protocol  was  achieved  and  an  alternative  solution  was 
developed. 

D,  CHAPTER  OVERVIEW 

As  outlined  in  Chapter  I,  the  introductory  chapter,  the  focus  of  this  thesis  was  to 
explore  the  feasibility  of  continuing  the  100  percent  air  cargo  screening  protocols  as 
required  by  Congress,  and  inversely,  exploring  the  possibility  that  a  risk-based 
intelligence  driven  process  could  be  established  from  existing  programs  that  would 
increase  the  resiliency  and  sustainability  of  international  air  cargo  security. 

Chapter  II  provides  an  overview  of  the  gaps  in  the  international  air  cargo  security 
practices,  and  the  necessity  for  the  creation  of  a  risk-based  intelligence  driven  air  cargo 
screening  protocol.  This  chapter  additionally  examines  what  has  worked  and  what  has  not 
worked  as  a  means  of  mitigating  this  threat  to  date. 

Chapter  III  provides  a  review  of  literature  related  to  the  international  air  cargo 
environment.  This  chapter  establishes  the  basis  for  understanding  the  literature  and 
research  that  has  been  generated  based  on  three  periods  of  emphasis.  These  three  periods 
include  the  pre-9/11  literature  as  it  relates  to  international  air  cargo,  the  post- 9/11 
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literatures,  and  the  literature  that  has  been  written  since  the  printer  toner  attacks  that 
occurred  in  October  2010. 

Chapter  IV  discusses  and  evaluates  the  U.S.  international  air  cargo  security 
protocols,  as  well  as  the  EU  international  air  cargo  protocols,  and  the  use  and  availability 
of  air  cargo  data  and  intelligence  and  its  limitations. 

Chapter  V  discusses  and  evaluates  the  jurisdictional  hurdles  faced  by  each  of  the 
three  systems.  Each  system  is  evaluated  according  to  the  legal  authority  the 
administrating  agency  has  to  implement  and  enforce  the  applicable  security  processes. 

Chapter  VI  evaluates  the  costs  associated  with  the  implementation  of  the  United 
States  100  percent  air  cargo  security  screening  requirement,  the  EU  implementation  of 
EU  regulation  1082/2012,  and  the  application  costs  associated  with  the  proposed  risk- 
based  intelligence  driven  air  cargo  security  protocol.  This  chapter  discusses  and  evaluates 
the  cost  to  industry  and  government. 

Chapter  VII  provides  an  outline  of  the  proposed  policy  changes  and  their 
implementation  in  international  air  cargo  security  systems.  This  chapter  discusses  the 
plausibility,  process,  and  benefits  of  instituting  the  proposed  policy  changes,  particularly 
in  contrast  to  those  aspects  of  the  congressionally  mandated  100  percent  air  cargo 
screening  process.  This  chapter  concludes  with  a  discussion  of  the  limitations  of  the 
research. 


11 


THIS  PAGE  INTENTIONALLY  LEET  BLANK 


12 


II  CHALLENGES 


A,  AIR  CARGO  GAP  ANALYSIS 

As  previously  discussed,  both  industry  and  government  have  been  unable  to  find  a 
suitable  solution  to  the  threat  of  an  lED  attack  on  the  aviation  industry.  In  particular, 
preventing  an  lED  attack  using  air  cargo  has  been  a  acutely  difficult  problem  to  solve. 
This  difficulty  was  underlined  by  the  successful  air  cargo  attack  and  the  medias  focus  on 
the  United  States  failure  to  close  known  security  gaps  as  highlighted  by  the  article  by 
Nick  McMaster  in  figure  2.  As  a  result  of  the  lack  of  an  efficient  process  to  secure  air 
cargo.  Congress  implemented  the  100  percent  air  cargo  screening  mandate.  While  this 
mandate  was  well  intentioned  and  the  steps  taken  to  attempt  to  implement  it  have 
improved  air  cargo  security,  the  unintended  fiscal  consequences  and  jurisdictional  gaps  of 
the  mandate  currently  make  implementation  impractical  if  not  impossible.  This  chapter 
evaluates  the  procedures  and  programs  that  have  been  developed,  as  well  as  the  gaps  that 
continue  to  exist. 


US  Knew  of,  Didn't  Close 
Air  Cargo  Security  Gaps 

Nov  a.  201-:>  T:4B  AM.  GET 

figure  2.  Cargo  Bomb  Was  Set  to  Blow  Up  over  the  United  States^s 


28  Nick  McMaster,  “Cargo  Bomb  Was  Set  to  Blow  Up  Over  US,”  November  10,  2010, 
http://www.newser.eom/tag/55738/l/cargo-bombs.html. 
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In  the  17  years  sinee  the  diseovery  of  the  Bojinka  plot,  private  industry,  the  FAA, 
and  now  the  ISA,  have  eonsistently  attempted  to  develop  a  technologieal  or  proeedural 
solution  to  the  threat  of  an  lED  on  an  airplane.  In  a  201 1  GAO  report,  Stephen  Lord,  the 
Director  of  Homeland  Security  and  Justice  Issues,  is  quoted  as  saying,  “In  the  almost  10 
years  that  have  passed  since  TSA  assumed  responsibility  for  aviation  security,  TSA  has 
spent  billions  of  dollars  and  implemented  a  wide  range  of  initiatives  to  strengthen  the 
layers  of  aviation  security.  However,  risks  to  the  aviation  system  remain.”29  Numerous 
protocols,  regulations  and  detection  equipment  have  been  deployed  with  the  intention  of 
mitigating  this  threat.  Of  note  is  the  most  recent  iteration  in  the  governmental  quest  for  a 
regulatory  solution  to  the  air  cargo  vulnerability.  In  2007,  Congress  passed  the  ATSA,  a 
portion  of  which  seeks  to  address  the  air  cargo  screening  vulnerability  by  mandating  the 
implementation  of  the  100  percent  air  cargo  screening  initiative.  This  initiative  requires 
that  all  cargo  placed  on  passenger  aircraft  must  receive  the  same  level  of  screening  to 
which  passengers  and  baggage  are  subject.  Despite  the  significant  investment  of  time  and 
money,  none  of  these  solutions,  to  include  the  100  percent  air  cargo-screening 
requirement,  have  been  completely  successful. 

The  greatest  air  cargo  vulnerability  remains  the  inability  to  extend  the  TSA  and 
CBP’s  administrative  authority  beyond  the  U.S.  border  effectively  to  mitigate  the  benefits 
that  an  effective  and  regulated  100  percent  air  cargo-screening  protocol  would  create. 
Each  agency’s  regulatory  capabilities,  while  sufficient  for  domestic  enforcement,  fall 
short  of  what  would  be  required  to  enforce  administrative  screening  requirements  in 
foreign  nations.  Charles  Dent  noted  in  his  2010  testimony  before  Congress,  “TSA  has  no 
clear  plan  in  place  to  address  foreign  in-bound  cargo,  thought  the  law  requires  it.  Why  is 
that?  Not  for  a  lack  of  effort,  but  because  of  a  lack  of  authority. ”30  This  weakness,  which 
has  been  exploited  by  narcotics,  human  and  counterfeit  merchandise  smugglers  for 
centuries,  remains  the  weakest  link  in  the  air  cargo  transportation  chain.  The  TSA  and 

^9  U.S.  Government  Accountability  Office,  “Testimony  Before  the  Subcommittee  on  National 
Security,  Homeland  Defense,  and  Foreign  Operations,  Committee  on  Oversight  and  Government  Reform, 
House  of  Representatives,”  Aviation  Security,  TSA  Has  Taken  Actions  to  Improve  Security,  but  Additional 
Efforts  Remain  Statement  of  Stephen  M.  Lord,  Director  Homeland  Security  and  Justice  Issues.” 

30  Dent,  “100  Percent  Air  Cargo  Screening:  Remaining  Steps  to  Secure  Passenger  Aircraft,  Hearing 
before  the  Subcommittee  on  Transportation  Security  and  Infrastructure  Protection.” 
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CBP  continue  to  seek  administrative  solutions  to  air  cargo  screening  problems  that  reach 
beyond  the  authority  granted  to  eaeh  of  these  agencies.  Additionally,  the  congressionally 
imposed  requirement  for  the  TSA  to  sereen  100  pereent  of  air  cargo  is  equally 
unenforceable  or  attainable.  Dent  stated  in  2010  that  the  “suceess  of  a  100  pereent 
sereening  requirement  will  depend  in  part  on  an  effective  inspeetion  and  enforeement 
program — we  cannot  simply  impose  a  requirement  and  declare  vietory.”3i  Unfortunately, 
beeause  the  administrative  and  regulatory  authority  of  CBP  and  the  TSA  ends  at  the  U.S. 
border,  a  100  percent  sereening  protocol  is  conceptually  ineffective. 

A  signifieant  amount  of  researeh  has  been  conducted  at  the  industry  and 
government  levels,  but  aeademia  has  not  yet  attempted  to  conduet  a  complete  analysis  of 
the  three  decades’  worth  of  data  available. 


31  Dent,  “too  Percent  Air  Cargo  Screening:  Remaining  Steps  to  Secure  Passenger  Aircraft,  Hearing 
before  the  Subcommittee  on  Transportation  Security  and  Infrastructure  Protection.” 
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III.  LITERATURE  REVIEW 


It  is  generally  agreed  among  industry  and  government  subjeet  matter  experts  that 
the  international  air  eargo  supply  ehain  remains  vulnerable  despite  the  30-year  pursuit  for 
an  answer  to  this  aviation  seeurity  gap.  This  is  illustrated  by  the  below  figure  whieh 
depicts  a  small  portion  of  the  numerous  stakeholders  involved  in  the  air  cargo  security 
enterprise. 


Millions  of  X 

— - 

-  “^so 

Known  ~ 

Shippers  'V 

*^lndRect  - 

Air  Carriers 

Carriersfj^  J 

Airports 

Air  Cargo  Environment  Overview 

Figure  3.  Air  Cargo  Environment  Overview ^2 


Legislative  measures,  international  agreements,  and  technological  solutions  have 
been  sought  and  unsuccessfully  applied  to  this  problem.  Much  of  the  research  conducted 
in  response  to  this  weakness  has  come  from  government  sources,  such  as  the  GAO, 
Congressional  Research  Service  (CRS),  and  the  Department  of  Homeland  Security  Office 
of  the  Inspector  General  (DHS/OIG).  The  Congressional  Committee  on  Homeland 
Security  has  held  hearings  and  received  testimony  from  industry  and  agency  leaders  on 
air  cargo  screening.  The  scope  of  this  literature  review  includes  documents  that  pertain  to 
air  cargo  security  during  the  pre-9/11,  the  post-/911,  and  the  post- 10/29  AQAP  printer 
toner  attack. 

The  pre-9/11  literature  includes  Ramsey  Yousefs  Bojinka  plot,  in  which  the 
radical  Islamist  was  able  to  design  and  test  an  explosive  device  capable  of  evading 
detection  during  the  passenger  screening  process.  The  intended  use  of  this  device  was  to 
conduct  a  coordinated  attack  on  U.S.  flagged  passenger  air  carriers  that  would  destroy  10 
passenger  aircraft  as  they  were  flown  over  the  Pacific  Ocean  while  traveling  to  the  United 
States.  This  period  additionally  includes  the  Libyan  sanctioned  terrorist  attack  on  Pan  Am 

22  Transportation  Security  Administration,  “Air  Cargo,  Office  of  Security  Policy  and  Industry 
Engagement,”  last  revised  January  9,  2013,  http://www.tsa.gov/stakeholders/air-cargo. 
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flight  103,  which  was  destroyed  by  an  explosive  deviee  seereted  within  the  baggage  hold 
of  the  aireraft.  These  two  attaeks  were  the  foeus  of  the  1996  Gore  Commission’s  report 
and  findings  on  aviation  security  for  the  core  of  the  decade’s  worth  of  available  literature 
on  the  subject  of  aviation  security. 

The  second  period  of  study  eovers  the  post- 9/ 11  literature  developed  in  response 
to  the  hijaeking  and  subsequent  destruetion  of  four  U.S.  flagged  air  earners.  While  air 
eargo  security  is  discussed  during  this  period,  it  is  ancillary  to  the  discussion  of  passenger 
screening  and  anti-hijaeking  technologies,  techniques,  and  eounter  measures.  The 
predominate  theory  during  this  10-year  period  was  that  terrorists  would  attempt  to  either 
hijaek  an  all-air-eargo  aireraft  as  a  means  of  reereating  the  9/11  attaeks,  or  that  terrorists 
would  attempt  to  smuggle  an  lED  onto  an  air  passenger  earrier  as  was  seen  during  the 
2006  liquid  bomb  plot,  and  the  2009  Christmas  day  attempted  underwear  bombing. 

The  third  period  of  review  eovers  the  literature  ereated  after  the  Yemen  printer 
toner  attaek  disrupted  by  Saudi  Arabian  intelligenee  on  Oetober  28,  2010.  It  is  during  this 
three-year  period  that  a  signifieant  shift  is  seen  in  the  aviation  seeurity  literature  with  a 
renewed  emphasis  towards  the  sereening  of  domestie  and  international  air  eargo.  It  is  in 
the  post  printer  toner  attack  period  that  the  100  pereent  air  eargo  screening  protoeol  was 
ereated  by  Congress  with  the  intention  of  improving  aviation  security.  Much  of  the 
literature  during  this  time  frame  diseusses  implementation  deadlines,  as  well  as  teehnical 
and  operational  obstacles  to  sueeessful  implementation. 

A  seareh  for  the  available  literature  was  eondueted  using  the  seareh  terms  aviation 
security,  air  cargo,  air  cargo  security,  and  international  air  eargo  seeurity  along  with  risk 
and  risk  mitigation.  This  seareh  resulted  in  the  discovery  of  a  significant  amount  of 
government  testimony,  analysis,  and  reports.  These  produets  inelude  CRS  and  GAO 
reports.  Congressional  testimony  and  industry  sponsored  papers  designed  to  analyze  the 
air  eargo  industries’  vulnerabilities  and  to  seek  and  evaluate  proposed  solutions. 
Government  and  industry  entities  with  a  direet  interest  in  air  eargo  seeurity  and  its 
eeonomie  and  operational  impaet  produee  the  majority  of  the  literature  and  researeh.  The 
review  has  been  organized  aeeording  to  three  distinet  historieal  periods  eorresponding  to 
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terrorist  activities  that  impacted  the  evolution  of  aviation  security:  the  pre-9/11  period, 
the  post-9/ 1 1  period,  and  the  post-AQAP  Printer  Toner  Air  Cargo  attack  period. 


A,  PRE-9/11  ATTACKS 

1.  International  Air  Cargo 

The  available  literature  and  studies  are  primarily  government  sponsored  and 
congressionally  mandated  analysis.  They  show  a  consistent  understanding  of  the  urgency 
of  the  problem  and  the  necessity  to  address  these  vulnerabilities.  What  the  pre-9/11 
literature  lacks  is  a  comprehensive  solution  to  the  risk  posed  by  international  air  cargo 
carried  on  all  cargo  and  all  passenger  aircraft.  While  the  government  experts  and 
committees  were  consistently  able  to  point  to  flaws  in  the  system  and  the  necessity  to 
ensure  these  vulnerabilities  are  addressed,  a  comprehensive  solution  to  the  problems  that 
balanced  the  needs  of  industry  and  government  were  not  presented  primarily  because  of 
the  lack  of  a  specific  and  credible  threat  to  the  industry.  Additionally,  the  tremendous 
jurisdictional  and  implementation  costs,  which  still  exist  today,  made  government  and 
industry  acceptance  improbable. 

GAO  noted  in  1994  that  the  FAA  would  need  to  balance  regulatory  oversight  of 
the  industry  without  impeding  commerce  or  creating  competitive  complications  to 
improve  the  nation’s  aviation  security  systems. 33  As  a  result,  the  FAA  established  the 
position  of  federal  security  manager  at  domestic  category  X  airports  and  security  liaison 
officers  at  international  locations  to  serve  as  the  FAA’s  representative  to  law 
enforcement,  security  and  airport/airline  mangers.  According  to  the  air  carriers,  despite 
the  FAA’s  attempt  to  balance  commerce  and  security,  the  necessity  for  U.S.  airlines  to 
comply  with  the  more  stringent  requirements  imposed  by  the  FAA  while  operating 
internationally,  place  a  greater  financial  obligation  on  the  U.S.  carriers  and  puts  them  at  a 
competitive  disadvantage.  34  A  1990  study  conducted  by  the  Department  of 
Transportation  was  unable  to  determine  if  the  competitive  disadvantage  exited.  Similarly, 

33  U.S.  Government  Accounting  Office,  Aviation  Security,  Additional  Actions  Needed  to  Meet 
Domestic  and  International  Challenges  (GAO/RCED-94-38),  Washington,  DC:  GPO,  January  1994, 
http://www.gao.gov/products/RCED-94-38. 

34  Ibid. 
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the  FAA  stated  that  it  reeognized  that  these  differenees  existed  and  while  they  had  not 
studied  the  subjeet,  they  did  not  believe  a  disadvantage  existed. 35  The  1994  GAO  report 
eoneluded  that  the  introduetion  of  new  measures  and  teehnology  in  the  eoming  deeades 
must  be  done  in  a  way  that  does  not  adversely  affeet  eommeree  and  the  industry. 36  The 
GAO  addressed  several  of  the  programs  ereated  in  response  to  the  Aviation  Seeurity  Aet 
of  1990  and  focused  a  large  part  of  its  auditing  efforts  on  cargo  carried  on  passenger 
aircraft.  37  The  GAO  stated  that  the  FAA  had  made  progress  in  designing  and 
implementing  steps  to  identify  airfreight  forwarders  as  a  means  of  improving  air  cargo 
security  awareness,  but  The  GAO  also  found  that  the  FAA  had  not  developed  an 
inspection  strategy  to  ensure  regulatory  compliance. 38  The  GAO  stated  that  the  success 
of  the  freight  forwarder  program  relied  upon  a  robust  and  effective  inspection  process 
and  that  the  lack  of  such  a  program  created  vulnerabilities.  39 

Two  years  after  that  report,  Keith  O.  Fultz,  the  Assistant  Comptroller  General, 
Resources,  Community  and  Economic  Development  Division,  GAO,  stated  in  his 
testimony  before  the  Congressional  Subcommittee  on  Aviation  that  the  threat  of  a 
terrorist  attack  on  American  aviation  had  increased,  and  significant  vulnerabilities  to  the 
system  continued  to  exist  both  domestically  and  internationally. 40  Of  note  was  the  threat 
of  the  introduction  of  explosives  to  aircraft  by  passengers,  baggage,  mail,  and  cargo.  At 
the  time  of  this  testimony,  the  FAA  considered  the  introduction  of  explosives  through 
checked  baggage  the  greatest  threat  to  aviation,  the  threat  of  unauthorized  access  to 
restricted  areas  of  the  airport  and  checked  baggage  being  the  next  greatest  threats.  Fultz 
further  noted  that  the  ability  to  screen  cargo  and  mail  at  airports  was  very  difficult 


35  PolicyFutures,  “Report  of  the  Presidents  Commissions  on  Aviation  Seeurity  and  Terrorism,”  May 
15,  1990,  http://www.polieyflitures.eom/PCAST/PCASTreport.pdf,  34. 

36  Ibid. 

37  Ibid. 

38  Ibid. 

39  Ibid. 

40  U.S.  General  Aeeounting  Offiee,  Testimony  Before  the  Subcommittee  on  Aviation,  Committee  on 
Transportation  and  Infrastructure  House  of  Representatives,  Aviation  Security,  Urgent  Issues  Need  to  Be 
Addressed,  Statement  of  Keith  O.  Fultz,  Assistant  Comptroller  General,  Resources,  Community,  and 
Economic  Development  Division  (GAO/T-RCED/NSAID-96-251),  Washington,  DC:  GPO,  1996. 
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because  of  the  size  and  scope  of  the  system  and  the  unpredictability  of  terrorism.  Fultz 
raised  two  questions  during  his  testimony,  whether  aviation  security  should  be  considered 
an  issue  of  national  security,  and  who  should  be  responsible  for  paying  for  the  costs 
associated  with  enhancing  the  air  security  process. Fultz  further  discussed  technological 
capabilities  in  his  testimony  to  the  Congressional  Committee  on  Science  and  again  noted 
the  urgent  need  for  the  FAA,  intelligence  communities,  and  industry  representatives  to 
decide  what  actions  needed  to  be  taken  and  who  would  pay  for  it.42 

2.  Pre-9/11  Risk 

Prior  to  the  attacks  on  9/11,  the  federal  government  and  private  industry  were 
using  risk  and  vulnerability  assessments  as  a  means  of  allocating  limited  resources  to 
sectors  that  faced  the  greatest  probability  of  attack  or  failure.  In  1988,  the  GAO  reported 
on  several  acts  that  Congress  had  passed  as  compared  to  the  practices  of  several  private 
industries. 43  Several  challenges  were  noted,  two  of  which  focused  on  the  intelligence 
community,  specifically,  the  inability  of  the  intelligence  community  to  share  valid  and 
specific  intelligence  to  end  users  who  would  then  be  able  to  adjust  their  security  posture 
to  limit  the  risk  associated  with  the  threat.  44  The  report  additionally  focused  on  the 
difficulty  associated  with  the  necessity  of  both  industry  and  government  to  provide  a 
thorough  evaluation  of  large  sectors  whose  scope,  magnitude,  and  complexity  made  such 
comprehensive  evaluations  difficult  if  not  impossible  to  validate. 45 

The  FAA  Reauthorization  Act  of  1996  (Public  Law  104-264),  established  the 
requirement  for  the  FAA  and  Federal  Bureau  of  Investigations  (FBI)  to  conduct  Joint 
Vulnerability  Assessments  (JVA)  with  the  intent  of  measuring  each  airport’s 

41  U.S.  General  Accounting  Office,  Testimony  Before  the  Subcommittee  on  Aviation,  Committee  on 
Transportation  and  Infrastructure  House  of  Representatives,  Aviation  Security,  Urgent  Issues  Need  to  Be 
Addressed,  Statement  of  Keith  O.  Fultz,  Assistant  Comptroller  General,  Resources,  Community,  and 
Economic  Development  Division. 
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vulnerabilities  and  level  of  risk."^^  Each  risk  assessment  evaluated  proposed  scenarios  that 
the  intelligence  communities  could  validate  or  determine  as  unlikely  based  on  available 
domestic  and  foreign  intelligence.  The  teams  used  to  conduct  these  JVAs  consisted  of 
risk,  security,  and  vulnerability  subject  matter  experts  and  were  employees  of  the  FBI  and 
FAA. 

In  contrast  to  the  government  process,  the  private  industries  interviewed  for  the 
report  conduct  tri-annual  assessments  using  teams  of  experts,  of  which  no  more  than  25 
percent  could  be  experts  in  security.  The  industries’  stated  intention  of  limiting  the 
number  of  security  experts  to  25  percent  was  to  ensure  that  a  diverse  assessment,  which 
focused  beyond  the  security  vulnerabilities,  was  created  that  would  better  identify  the 
unpredictable  risks  a  team  of  security  experts  would  not  see. 

In  1998,  the  GAO  conducted  a  comparative  analysis  of  the  private  sector’s  five- 
step  risk  assessment  process  to  the  joint  FAA  and  FBI  system  as  was  mandated  by  the 
Federal  Aviation  Reauthorization  Act  of  1996.  While  the  joint  FAA  and  FBI  system 
relied  on  an  annual  evaluation  and  assessment  of  the  vulnerabilities  of  category  X 
airports,  it  did  not  include  an  evaluation  of  the  probability  of  such  attacks  successfully 
occurring. 

As  previously  stated,  the  public  sector  oil  company  analyzed  utilized  a  five-step 
process  that  included  the  following  evaluation  criteria. 

1 .  Determine  the  value  of  assets  and  judge  the  consequences  of  the  loss  of 
those  assets 

2.  Identify  the  threats  and  pair  them  with  the  assets 

3.  Identify  the  assets  vulnerabilities 

4.  Determine  risks  through  the  application  of  scenarios 

5.  Identify  actions  as  necessary  that  lead  to  risk  reduction^^ 
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In  contrast  to  the  manner  in  whieh  the  FAA  and  FBI  conducted  risk  and  threat 
assessments,  the  oil  company  gathered  a  diverse  group  of  subject  matter  experts  and 
identified  vulnerabilities  and  aetions  to  be  taken  to  mitigate  the  risk  the  vulnerability 

created.  48 

The  congressional  budget  for  fiscal  year  2001  for  eombating  terrorism  was  set  at 
$11  billion.  49  This  funding  level  was  in  a  large  part  established  through  the  evaluation  of 
the  industry  and  governmental  vulnerabilities  and  the  intent  of  known  terrorist 
organizations.  While  the  intent  of  a  terrorist  organization  is  a  reasonable  indieator  of  a 
risk,  the  GAO  report  established  the  capability  of  the  terrorist  organization  to  conduct  the 
intended  attaek  as  a  better  determinant  of  where  pereeived  versus  aetual  risks  exist,  In 
2000,  federal  efforts  were  focused  on  vulnerabilities  rather  than  analyzing  the  eredibility 
of  the  threat  caused  by  the  identified  vulnerabilities.  In  2000,  the  intelligence 
communities  assessed  that  explosives  and  firearms  were  the  preferred  weapons  of 
terrorists  and  posed  the  greatest  risk.  Since  these  assessments  were  the  tools  used  for 
prioritizing  the  government’s  counter-terrorism  investments,  in  2001,  the  government 
focused  on  these  threats. 

In  contrast  to  the  manner  in  whieh  the  United  States  establishes  vulnerabilities 
and  risk,  the  GAO  evaluated  five  foreign  countries  policies  and  praetices  for  establishing 
risk  and  alloeating  limited  resources.  These  eountries  included  in  the  report  were  Canada, 
France,  Germany,  Israel,  and  the  United  Kingdom.  The  GAO  found  in  report  NSAlD-00- 
85,  that  the  countries  studied  alloeated  their  resourees  based  on  the  likelihood  of  threats 
becoming  attacks  based  on  the  available  intelligence.  Unlike  in  the  United  States,  the 
intelligence  communities  of  the  five  countries  evaluated  would  eontinuously  assess  the 
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threats  to  determine  whieh  ones  posed  the  greatest  risk-based  on  the  probability  of  them 
occurring.  The  countries  would  then  assign  assets  to  counter  the  risk  from  sectors  at  a 
lesser  risk  of  attack  by  having  used  the  risk  and  threat  assessments  as  a  means  of 

prioritizing  budgetary  allocations.  ^2 

B,  POST-9/11  ATTACKS 

1.  International  Air  Cargo 

Since  the  attacks  on  September  11,  2001,  groups  within  the  U.S.  government  have 
completed  numerous  reports  and  evaluations  of  the  existing  vulnerabilities  in  the  aviation 
security  and  the  air  cargo  supply  chain.  The  GAO  (2002)  provided  testimony  before  the 
U.S.  Senate  Committee  on  Commerce,  Science  and  Transportation  outlining  the 
immediate  and  long-term  challenges  that  the  TSA  would  face  while  preparing  to  secure 
the  nation’s  transportation  systems.  Dr.  Gerald  L.  Dillinham,  the  Director  of  Physical 
Infrastructure  Issues,  GAO  noted  during  his  testimony  that  securing  the  nation’s  aviation 
systems  would  be  a  difficult  task,  in  particular,  the  need  to  meet  mandated  deadlines 
while  creating  a  federal  agency.  ^3  At  the  time  of  his  testimony  in  2002,  two  bills 
designed  to  address  identified  deficiencies  in  the  air  cargo  supply  chain,  S.  2656  and  S. 
2668,  were  pending  ratification  by  the  U.S.  Senate.  S.  2656  required  the  head  of  the  TSA 
to  establish  a  security  plan  for  the  transportation  of  cargo  in  and  out  of  the  United  States. 
S.  2668  required  the  head  of  the  TSA  to  establish  a  system  to  screen  cargo  in  all 
passenger  and  cargo  aircraft.  Neither  bill  came  to  the  floor  for  a  vote,  but  rather,  each  was 
read  and  referred  to  the  Committee  on  Commerce,  Science  and  Transportation  for  further 
discussion. 

According  to  the  2002  GAO  report  on  Vulnerabilities  and  Potential  Improvements 
for  the  Air  Cargo  System  of  2002,  the  FAA  and  TSA  failed  to  develop  a  comprehensive 
plan  for  eliminating  vulnerabilities  in  the  air  cargo  system  as  had  been  identified  and 

32  U.S.  General  Accounting  Office,  Report  to  Congressional  Requesters,  Combating  Terrorism,  How 
Five  Foreign  Countries  Are  Organized  to  Combat  Terrorism  (GAO/NSIAD-00-85),  Washington,  DC: 
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recommended  by  the  1990  Gore  Commission. ^4  The  failure  of  the  TSA  to  identify  and 
eliminate  these  vulnerabilities  had  the  potential  to  threaten  the  air  transport  system.  The 
ISA’s  focus  on  securing  passenger  and  baggage  screening  was  identified  as  a  significant 
contributing  factor  for  this  failure.  The  GAO  noted  that  while  the  TSA  had  made  progress 
in  passenger  and  baggage  screening,  it  had  failed  to  develop  a  comprehensive  plan  and 
long-term  goals  for  air  cargo  security. 

The  TSA  and  CBP  released  the  Air  Cargo  Strategic  Plan  in  2003,  which  was 
designed  to  provide  a  road  map  for  both  agencies  to  implement  threat-based,  risk- 
managed  strategies  to  the  air  cargo  environment.  ^6  The  TSA  and  CBP  stated  that  the 
release  of  the  plan  was  intended  to  address  issues  raised  in  the  GAO  report  of  December 
2002  and  the  Department  of  Transportation’s  Office  of  the  Inspector  General  report  from 
September  2002.  Despite  developing  an  air  cargo  security  plan  designed  to  manage  the 
various  risks  in  the  air  cargo  environment,  the  TSA  also  acknowledged  that  successfully 
accomplishing  such  a  task  would  be  difficult.  57 

As  noted  by  the  GAO  in  2005,  the  TSA  had  begun  to  take  steps  towards  securing 
the  air  cargo  supply  chain  by  applying  a  risk-based  strategy  to  assess  vulnerabilities  by 
beginning  to  focus  on  two  specific  air  cargo  threats.  The  threats  identified  were  the 
possible  introduction  of  an  explosive  device  on  a  passenger  aircraft  and  the  hijacking  of 
an  all-cargo  aircraft.  These  priorities  were  consistent  with  ISA’s  2003  Air  Cargo 
Strategic  Plan.  Some  air  cargo  industry  leaders  agreed  with  the  ISA’s  use  of  the  two 
identified  threats,  but  other  air  cargo  specialist  noted  that  a  gap  existed  in  the  air  cargo 
threat  assessment  outlined  in  the  Air  Cargo  Strategic  Plan.  Specifically,  the  industry 
stakeholders  were  concerned  with  the  failure  of  the  TSA  to  recognize  the  threat  of  an 
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explosive  deviee  being  plaeed  on  an  all-cargo  aircraft. The  TSA  addressed  these 
concerns  with  the  GAO  in  2005  by  stating,  “TSA  decided  to  focus  on  the  two  threats 
cited  above  because  they  are  the  most  likely  to  occur.”^^ 

A  report  to  Congress  by  the  CRS  in  2007  noted  that  the  air  cargo  system 
continued  to  be  vulnerable  to  terrorist  plots  involving  the  placement  of  explosives  in 
passenger  and  all  cargo  aircraft.  The  110th  Congress  clarified  the  processes  required  to 
properly  screen  air  cargo  in  the  Implementing  the  9/11  Commission  Recommendations 
Act  of  2007  (H.R.l).  Specifically,  the  act  required  100  percent  of  air  passenger  cargo  be 
screened  with  the  equivalent  process  used  to  screen  passengers  and  checked  baggage. 
Industry  stakeholders  and  leaders  argued  that  this  provision  was  not  a  practical  solution 
and  that  it  would  present  significant  costs  and  challenges  for  the  air  cargo  industry.  David 
Wirsing  of  the  Airforwarders  Association  stated  that  the  cost  would  be  “over  700  million 
dollars  in  the  first  year  alone,”  while  TSA  spokeswoman  Andrea  McCauley  placed  the 
10-year  cost  estimate  at  $3.6  billion. A  subsequent  CRS  analysis  placed  the  cost  at 
$3.75  billion  over  the  same  decade. 

In  2007,  the  Homeland  Security  Council  (HSC)  published  the  National  Strategy 
for  Homeland  Security  in  which  it  described  the  possibility  of  terrorist  agents  exploiting 
the  global  supply  chain  to  smuggle  weapons  of  mass  destruction  into  the  United  States 
and  create  catastrophic  events.  GAO  highlighted  in  2007  that  the  two  agencies 
responsible  for  the  security  of  international  air  cargo,  the  TSA  and  CBP,  had  begun  to 
implement  inbound  air  cargo  security  protocols,  but  also  noted  that  CBP  and  the  TSA  had 
failed  to  establish  goals  and  time  frames  for  fully  implementing  the  processes.  Of 
particular  note  in  the  GAO  report  was  the  failure  of  the  TSA  and  CBP  to  establish  open 
communication  regarding  each  agency’s  air  cargo  security  efforts,  intelligence  and 
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technology  developments.  The  GAO  supported  this  view,  which  noted  that  TSA  officials 
acknowledged  that  vulnerabilities  continued  to  exist  in  both  the  international  and 
domestic  air  cargo  supply  chains,  and  that  the  TSA  did  not  have  the  necessary  screening 
and  compliance  resources  needed  to  eliminate  these  supply  chain  vulnerabilities. ^2 

The  GAO  noted  in  2008  that  while  the  TSA  had  made  progress  in  securing  the  air 
cargo  supply  chain,  programs  that  had  been  developed  to  ease  the  burden  on  the  shipping 
industry  had  created  new  vulnerabilities  within  the  air  cargo  supply  chain.  It  was  noted 
that  the  TSA  had  sought  to  balance  the  need  for  commerce  and  security  by  providing 
industry-screening  exemptions  in  the  domestic  and  international  air  cargo  processing.  ^3 
The  TSA  stated  that  it  used  a  threat  and  vulnerability  assessment  to  determine  which 
cargo  to  exempt,  but  the  GAO  stated  that  the  TSA  had  a  limited  ability  to  make  realistic 
risk-based  exemptions  and  doing  so  increased  vulnerabilities  in  the  air  cargo  supply 
chain.  According  to  a  2009  DHS/OIG  report,  programs  developed  by  the  TSA  to  prevent 
the  terrorist  and  criminal  exploitation  of  the  air  cargo  security  supply  chain,  such  as  the 
Known  Shipper  Program  (KSP),  had  failed. evaluation  was  supported  by 
DHS/OIG,  which  conducted  an  audit  of  the  KSP  and  the  Known  Shipper  Management 
System  (KSMS),  and  found  that  significant  technical  and  procedural  issues  remained 
within  the  systems,  and  that  these  issues  created  unnecessary  vulnerabilities  within  the 
domestic  and  international  air  cargo  supply  chain. 

In  September  2010,  the  DHS/OIG  published  an  unclassified  summary  of  the  TSA 
procedures  for  screening  air  cargo  on  passenger  aircraft.  The  DHS/OIG  spoke  to  the 
strengths  and  weaknesses  of  the  explosive  trace  detection.  X-ray,  physical  search,  and 
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TSA-certified  canine  teams.  The  DHS/OIG  also  provided  the  TSA  with  a  list  of  the 
vulnerabilities  that  the  audit  had  deteeted  and  that  TSA  aeknowledged  that  weaknesses  in 
the  global  air  eargo  supply  ehain  eontinue  to  exist. 


2,  Post-9/11  Risk 

In  the  post- 9/ 11  reeords  dealing  with  risk,  three  elements  have  beeome  a  part  of 
the  evolution  of  the  risk  equation.  In  GAO-02-I50T,  the  tools  for  measuring  these 
elements  were  identified  as  threat  assessments,  vulnerability  assessments,  and  eritieality 
assessments.  The  predominant  thought  in  the  post  9/11  world  was  that  while  risk  eannot 
be  eliminated,  it  ean  be  redueed  and  eaeh  assessment  provided  an  opportunity  to  measure 
risk.  Vulnerability  assessments  are  used  to  identify  weaknesses,  eritieality  assessments, 
identify  assets,  and  threat  assessments  measure  the  intent  and  eapability  of  nefarious 
operators. 

In  February  2007,  CRS  doeumented  the  evolution  of  the  DHS  risk  measuring 
methodology  beginning  with  2002  in  report  RL33858.  At  the  start  of  this  evolution,  a 
maturing  of  the  risk  evaluation  proeess,  and  subsequently,  the  equation,  is  beginning  to 
be  seen.  Initially,  the  risk  equation  determined  that  R  (risk)  =  P  (population).  Over 
time,  as  the  risk  assessment  proeess  matured,  the  equation  began  to  eontain  more 
variables.  In  2004-2005,  the  risk  equation  beeame  R  =  T  (threat)  +  Cl  (eritieal 
infrastrueture)  +  PD  (population  density).  It  further  evolved  through  2007  to  beeome 
the  now  familiar  R  =  T  x  V  (vulnerability)  x  C  (eonsequenee).^*’  The  applieation  of 
“geographieally-based  risk”  is  diseussed  during  this  period  as  well.  Geographieally  based 
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risk  considers  several  eharaeteristies,  sueh  as  regionally  reported  threats,  as  well  as  law 
enforcement  investigations  and  aetivity.  In  addition  to  these  faetors,  geographieally  based 
risk  analysis  considers  the  vulnerability  faetors  of  the  region  and  the  impaet  of  an  attaek 
on  the  area.  The  CRS  did  note  that  despite  the  evolution  of  the  risk  equation,  the  value 
of  the  threat  was  limited  to  the  available  federal  investigative  and  intelligence 

information.  72 

In  his  2008  discussion  paper,  Robert  Poole  reviewed  the  application  of  risk 
models  to  aviation  security,  and  concluded  that  at  the  time,  the  majority  of  the 
governmental  risk-based  diseussions  were  simply  rhetoric,  stating,  “much  of  the  aetual 
policy  changes  appear  to  have  been  driven  by  politieal  imperatives  to  reassure  frightened 
populations  that  air  travel  is  still  safe. ”73  Poole  eontinued  to  note  that  sinee  2005,  the 
TSA  had  made  very  few  attempts  to  move  to  a  risk-based  approach  to  aviation  security, 
and  that  the  failure  of  the  DHS  and  the  TSA  to  establish  or  apply  an  integrated  risk 
protoeol  had  also  been  noted  by  the  GAO  in  August  2007.74  In  his  conclusion,  Poole 
discussed  the  faet  that  most  aviation  security  and  safety  polices  are  the  results  of  attacks 
or  accidents,  and  as  such,  do  not  seek  solutions  to  possible  future  terrorist  attaoks.75  In  a 
RAND  paper  designed  to  evaluate  the  Department  of  Homeland  Security  as  it  approached 
its  first  change  in  exeeutive  power  sinee  its  ineeption,  Brian  Jaekson  and  David  Frelinger 
noted  that  it  was  not  possible  to  respond  to  all  threats  without  eausing  unneeessary 
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73  Poole,  Toward  Risk-Based  Aviation  Security  Policy. 
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economic  damage.^^  Instead,  a  cost  effective  and  sustainable  security  model  should  be 
designed  that  does  not  ignore  the  novel  risks  and  threats.^^ 


C.  POST-PRINTER-TONER  ATTACK 

1.  International  Air  Cargo 

On  October  29,  2010,  an  operative  from  AQAP  delivered  two  packages 
containing  explosive  devices  with  timers  to  the  UPS  and  FedEx  processing  centers  in 
Yemen.  Information  provided  by  the  Saudi  Arabian  intelligence  service  assisted  in  the 
detection  of  the  devices  before  detonation. 

In  December  2010,  the  CRS  published  “Screening  and  Securing  Air  Cargo: 
Background  Issues  for  Congress,”  which  highlights  policies  and  processes  that  were 
being  employed  by  the  TSA  and  CBP.  Of  note  were  the  TSA’s  continued  efforts  to  work 
with  international  partners  to  increase  international  air  cargo  screening  and  their 
continued  inability  to  accomplish  the  congressionally  mandated  100  percent  air  cargo¬ 
screening  mandate.  The  CRS  described  several  obstacles  inhibiting  the  TSA’s  ability  to 
comply  with  the  mandate.  These  obstacles  included  the  lack  of  the  regulatory  authority  to 
define  foreign  screening  requirements,  an  inability  to  enforce  screening  requirements 
developed  by  the  TSA,  and  a  lack  of  industry  support  for  the  cost-ineffective  100  percent 
screening  mandate.  As  a  result,  the  TSA  and  CBP  had  begun  to  institute  a  risk-based 
inspection  strategy. 

In  addition,  the  CRS  noted  that  the  Implementing  the  9/1 1  Commission 
Recommendations  Act  of 2007  had  defined  what  processes  would  not  quality  as  air  cargo 
screening,  but  failed  to  designate  who  was  responsible  for  conducting  the  screening. As 
a  result,  the  TSA  placed  the  requirement  for  conducting  air  cargo  screening  on  the 
airlines,  freight  forwarders,  shippers,  manufacturers,  and  third  party  screening  facilities. 

B.  Jackson  and  D.  Frelinger,  Emerging  Threats  and  Security  Planning,  How  Should  We  Decide 
What  Hypothetical  Threats  to  Worry  About? ,  RAND  Corporation,  2009. 

77  Ibid. 

78  Bart  Elias,  Screening  and  Securing  Air  Cargo:  Background  and  Issues  for  Congress,  CRS  R41515 
(Washington,  DC:  Library  of  Congress,  Congressional  Research  Service,  December  2,  2010), 
http://assets.opencrs.eom/rpts/R41515_20101202.pdf 
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The  TSA  cited  a  lack  of  assets  available  for  conducting  the  screening  operations  as  the 
reason  for  shifting  the  responsibility  for  screening.  The  GAO  further  supported  this  in 
2011  while  highlighting  the  TSA’s  failed  efforts  to  conduct  foreign  all  air  cargo  airport 
threat  assessments.  It  was  stated  that  the  TSA  was  unable  to  establish  reasonable  goals 
and  target  completion  dates  for  conducting  threat  assessments  at  the  17  air  cargo 
international  hubs  due  to  the  lack  of  the  necessary  TSA  manpower,  funding,  and 
authority. 

The  DHS  published  the  joint  CBP/TSA  Air  Cargo  Advanced  Screening  Pilot 
Strategic  Plan  in  March  2012.^9  strategic  plan  outlines  the  process  proposed  by  CBP 
and  the  TSA  to  identify  and  screen  high-risk  air  cargo  shipments  without  impeding  the 
flow  of  commerce.  CBP  and  the  TSA  stated  that  the  pilot  process  would  establish  a  tiered 
six-stage  implementation  process  with  the  intention  of  expanding  the  trusted  shipper 
concept  as  a  means  of  achieving  the  100  percent  air  cargo-screening  mandate.  The  GAO 
in  2012  reviewed  the  steps  that  the  TSA  had  taken  to  address  vulnerabilities  to  the  air 
cargo  supply  chain,  GAO  found  that  vulnerabilities  continued  to  exist  in  AC  AS 

implementation  due  to  regulatory  limitations  in  the  international  air  cargo  environment. 
Additionally,  screening  vulnerabilities  had  been  highlighted  by  the  failure  of  the  existing 
explosives  detection  technology  to  discover  the  devices  used  in  the  Yemen  attack. 

The  GAO  determined  that  the  air  cargo  industry  was  unwilling  to  endure  the 
disruptions  in  the  supply  chain  caused  by  the  rapid  lifting  of  screening  exemptions  to 
cargo  classes  and  that  the  TSA  had  not  accounted  for  the  necessity  to  allow  time  for  the 
industry  to  adapt  to  the  new  processes  and  procedures.  These  changes  additionally  caused 
industry  confusion  about  the  appropriate  screening  process,  which  then  caused  lapses  in 
air  cargo  screening  protocols.  The  GAO  noted  that  the  TSA  continued  to  encounter 


U.S.  Department  of  Homeland  Security,  U.S.  Customs  and  Border  Protection  Transportation 
Security  Administration,  “Air  Cargo  Advanced  Screening  Pilot  Strategic  Plan,”  March  2012,  http://www. 
cbp.gov/linkhandler/cgov/trade/cargo_security/cargo_control/acas_psplan.ctt/acas_psplan.pdf 

U.S.  Government  Accountability  Office,  Report  to  Congressional  Requesters,  Aviation  Security: 
Actions  Needed  to  Address  Challenges  and  Potential  Vulnerabilities  Related  to  Securing  Inbound  Air 
Cargo  (GAO  12-632),  Washington,  DC:  GPO,  2012,  http://www.gao.gov/assets/600/590789.pdf 
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challenges  and  obstaeles  to  meeting  the  100  percent  air  cargo  screening  protocol  and  had 
to  postpone  the  implementation  of  the  mandate  continuously. 

2.  Post-Printer-Toner  Attack  Risk 

In  2012,  the  RAND  Homeland  Security  and  Defense  Center  conducted  an 
independent  assessment  of  the  ISA’s  risk  management  analysis  tool  used  to  simulate 
terrorist  behavior  and  the  probability  of  successful  attacks  on  the  domestic  commercial 
air  system.  RAND  determined  that  the  model  is  significantly  dependent  on  identification, 
validation,  and  maintenance  of  the  approximately  4,300  input  valuations  through  the 
continued  use  of  subjeet  matter  expert  data,  but  despite  this,  the  system  was  a  significant 
improvement  over  the  previously  rudimentary  system  employed  by  the  TSA.^i  RAND 
determined  that  the  ISA  needed  to  adopt  risk  evaluation  polices  capable  of  covering  a 
broad  range  of  evolving  risks  rather  than  ereating  programs  that  addressed  singular 

threats.  ^2 


RAND,  Homeland  Security  and  Defense  Center,  Modeling  Terrorism  Risk  to  the  Air  Transportation 
System,  2012. 

82  Ibid. 
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IV.  RISK 


Risk  analysis  has  played  a  role  in  the  industry  and  governmental  deeision 
proeesses  for  a  signifieant  period  of  time.  The  applieation  of  risk  models  to  air  eargo 
sereening  protoeols  is  a  natural  progression  of  the  seeurity  industry  as  this  nation  moves 
further  away  from  the  attaeks  on  9/11.  The  necessity  to  employ  the  limited  resources 
available  to  government  and  industry  effectively  and  efficiently,  as  opposed  to  continuing 
the  implementation  the  100  percent  air  cargo  screening  protocol,  requires  the  adoption  of 
an  intelligent  risk-based  process.  The  risk  analysis  and  mitigation  cycle  includes  five 
major  components;  Identify  the  risk,  assess  the  risk,  create  a  mitigation  plan  and 
implement  the  plan  while  ensuring  clear  communication.  This  chapter  explores  these 
options  and  the  feasibility  of  applying  the  risk  analysis  and  mitigation  cycle  as  it  would 
apply  to  the  United  States,  the  European  Union,  and  the  proposed  air  cargo  screening 
policy. 


At  the  heart  of  this  discussion  is  the  failure  of  the  100  percent  air  cargo  security 
requirement  to  consider  the  importance  of  including  risk  as  a  factor  in  the  evaluation  of 
the  threat  presented  by  international  air  cargo.  Just  as  not  all  passengers  present  an  equal 
risk  to  aircraft,  not  all  air  cargo  poses  an  equal  risk  to  aircraft.  The  TSA  has  recently 

Edaptive  Computing  Inc.,  “Risk  Analysis  and  Mitigation,  n.d.,  http://www.edaptive.com/solutions/ 
capabilities/riskmanagement.aspx. 
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adopted  Risk  Based  Passenger  Screening  through  the  implementation  of  initiatives 
designed  to  improve  aviation  security  by  concentrating  security-screening  efforts  on 
those  passengers  who  pose  the  greatest  potential  risk  to  the  aviation  industry,  which  has 
been  accomplished  through  the  adoption  of  several  risk  assessing  programs.  These 
programs  include  the  highly  publicized  Pre/,  screening  of  active  duty  U.S.  service 
members,  managed  inclusion  and  the  over  75  and  fewer  than  12  provisions.*"^  This 
chapter  discusses  the  risk  assessment  processes,  or  the  lack  thereof,  used  in  the  United 
States  and  the  European  Union  air  cargo  security  environment  used  as  a  means  of 
applying  the  appropriate  security  screening  process  to  air  cargo  shipments. 

Within  the  United  States,  domestic  air  cargo  transported  on  passenger  aircraft  is 
required  to  be  screened  at  a  level  commensurate  with  the  level  of  screening  provided  to 
passenger  baggage.  *5  In  accordance  with  the  Implementing  Recommendations  of  the  9/11 
Commission  Act  of  2007,  the  100  percent  screening  process  for  domestic  cargo  on 
passenger  aircraft  was  to  be  completed  by  August  2010.  To  meet  this  requirement,  the 
TSA  implemented  a  multi-layered  approach  for  the  vetting  and  screening  of  domestic 
cargo  shipments  in  the  air  cargo  supply  chain.  Several  programs  were  established  or 
enhanced  as  a  means  of  maximizing  the  reliability  of  this  layered  security  approach.  They 
include  but  are  not  limited  to  CCSP,  Certified  Cargo  Screening  Facility  (CCSF),  the 
Indirect  Air  Carrier  (lAC)  Program,  the  lAC  Management  System  and  the  Know  Shipper 
Program.  These  programs  form  the  core  of  the  TSA  domestic  air  cargo  security  system. 

The  CCSP  was  created  as  a  means  of  allowing  industry  to  screen  piece  level  cargo 
prior  to  its  being  delivered  to  the  air  carrier  with  the  intent  of  meeting  the  100  percent 
screening  requirements,  which  was  additionally  done  to  accomplish  the  screening 
requirement  without  placing  the  entire  responsibility  on  the  air  carriers  who  do  not  have 
the  capacity  to  provide  the  appropriate  level  of  screening  to  meet  the  mandate.*^  The 
CCSP  is  a  voluntary  program  that  allows  the  TSA  to  assess,  validate,  and  regulate  CCSFs 

Transportation  Security  Administration,  “Risk-Based  Security  Initiatives,”  n.d.,  http://www.tsa. 
gov/traveler-information/risk-based-security-initiatives. 

Transportation  Security  Administration,  “The  International  Air  Cargo  Association,”  May  2008, 
http://www.hsdl.org/?view&did=14323. 

Transportation  Security  Administration,  “Certified  Cargo  Screening  Program.” 
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that  will  conduct  air  cargo  screening  prior  to  the  cargo  being  delivered  to  the  air  carrier. 
The  CCSF  pieee  level  screening  allows  sereened  and  palletized  eargo  to  be  uploaded  to 
passenger  aircraft  without  further  inspeetion  unless  risk-based  or  randomized  sereening  is 
performed.  The  CCSP  is  regulated  by  the  TSA.  As  sueh,  the  assoeiated  CCSF  is  subject 
to  inspection  by  Transportation  Security  Inspectors-Cargo  (TSI-C)  who  ensure  regulatory 
and  program  eomplianee. 

lACs  are  “engaged  indirectly  in  the  air  transportation  of  property  on  aircraft”  and 
are  subjeet  to  TSA  inspeetion  at  any  time.*^  Additionally,  the  TSA  uses  the  Indireet  Air 
Carrier  Management  System  (lACMS)  to  validate  and  approve  existing  and  new  lACs. 
The  lACMS  process  was  developed  as  a  means  for  the  TSA  to  gather  pertinent 
information  about  lACs  around  the  eountry  and  assists  in  the  performanee  of  Security 
Threat  Assessments  (STA)  eonducted  on  employees  of  the  eompanies.  The  next  seeurity 
layer  in  the  TSA  air  eargo  seeurity  proeess  is  the  KSMS  ereated  for  shippers  who  did  not 
want  to  beeome  lACs.  This  seeurity  proeess  allows  known  shippers  based  within  the 
United  States  to  be  verified  and  eertified  as  legitimate  shippers  by  the  TSA,  whieh  is 
aeeomplished  after  a  systematie  risk  assessment  and  determination  of  legitimaey  is  made 
by  the  TSA.  As  of  the  third  quarter  of  2008,  the  TSA  had  proeessed  1.4  million  shippers 
through  the  KSMS. 

The  TSA  has  resourees  within  the  domestie  air  eargo  seeurity  regulatory 
framework  as  well.  One  of  these  programs  ineludes  the  explosive  deteetion  eanines 
employed  in  the  air  eargo  seeurity  venue.  Theses  eanines  are  employed  speeifieally  to 
elear  bulk  air  eargo  to  be  uploaded  onto  passenger  aireraft  at  the  nation’s  busiest 
airports.**  In  addition  to  being  trained  as  a  eanine  offieer,  the  handlers  are  fully  eertified 
transportation  seeurity  inspeetors  eapable  of  looking  for  regulatory  violations. 

The  lAC  Sereening  Teehnology  Pilot  is  a  pilot  program  available  within  the  TSA, 
whieh  is  an  initiative  established  as  a  means  of  allowing  high  volume  air  eargo 

*^  U.S.  Government  Printing  Offiee,  49  CFR-Part  1548  Indirect  Air  Carrier  Security  Section  1 
Applicability,  2010. 

**  Transportation  Seeurity  Administration,  “TSA  Canine  Program  Enhanees  Air  Cargo  Seeurity,” 
Oetober  17,  2008,  http://www.tsa.gov/press/releases/2008/10/17/tsa-canine-program-enhanees-air-eargo- 
security. 
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transporters  to  test  sereening  teehnology  provided  by  the  TSA  in  an  air  eargo 
environment  as  a  means  of  gathering  data  on  the  teehnology’ s  validity.  While  these 
seeurity  layers  provide  a  robust  system  for  the  deteetion  and  deterrenee  of  explosives  in 
air  eargo  within  the  borders  of  the  United  States,  they  are  ineapable  of  providing  a  similar 
layer  of  seeurity  for  inbound  international  air  eargo. 

The  signifieant  differenee  between  the  U.S.  and  the  EU  regulations  is  that  the  EU 
regulations  state  that  allowanees  must  be  made  for  individual  airports  “in  the  light  of  the 
loeal  risk  assessment.”^^  statement  is  distinetly  different  from  the  federalized 

seeurity  system  that  has  been  implemented  within  the  United  States.  Unlike  the 
regulatory  guidanee  provided  by  the  European  Union,  the  United  States  ereated  an  all 
hazards  proeess  that  does  not  allow  for  distinetions  between  the  varying  levels  of  risk 
assoeiated  with  eonveyanees,  points  of  departure,  or  passenger  and  paekage  threats. 


Official  Journal  of  the  European  Union,  “Commission  Regulation  (EC)  No  622/2003  of  4  April 
2003,”  2003,  http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2003:089:0009:0010:EN:PDF. 


36 


V.  DATA  AND  INTELLIGENCE  EVALUATION 


Data  and  intelligence  gathering  and  evaluation  are  often  the  subject  of  public 
debate.  The  real  and  perceived  abuses  of  private  industry  and  government  agencies  and 
the  privacy  violations  caused  by  these  abuses  make  the  discussion  of  expanding  these 
types  of  programs  difficult.  While  the  illicit  gathering  of  data  is  a  real  issue,  this  chapter 
looks  to  explore  the  feasibility  and  practicality  of  gathering  and  analyzing  voluntarily 
supplied  industry  data  and  information. 

The  use  of  public  and  commercial  shipping  data  and  intelligence  products  as  a 
means  of  mitigating  risk  has  been  the  subject  of  debate  from  early  on  in  aviation 
antiterrorism  discussions.  So  much  so  that  in  1990,  the  Aviation  Security  Improvement 
Act  Congress  established  the  necessity  for  the  FBI  and  FAA  to  conduct  joint 
vulnerability  assessments  at  all  the  nation’s  largest  airports  as  means  of  identifying 
vulnerabilities,  and  ultimately,  as  a  vehicle  for  reducing  risk  by  designing  solutions  to 
these  vulnerabilities,  This  chapter  discusses  the  role  of  voluntarily  provided  shipping 
data  and  intelligence  in  the  current  U.S.  domestic  air  cargo  model,  the  EU  air  cargo 
model,  and  the  proposed  international  air  cargo  model. 

A,  THE  U.S.  AIR  CARGO  SYSTEM 

The  TSA  is  exclusively  responsible  for  regulating  the  handling  and  security  of 
domestic  air  cargo.  As  a  means  of  accomplishing  this  task,  it  has  implemented  several 
programs  that  leverage  data  collection  as  a  way  of  mitigating  the  threat  of  a  domestic  air 
cargo  attack.  As  a  part  of  this  process,  the  TSA  created  a  multi-layered  data  collection 
process  that  allows  for  the  evaluation  of  parties  interested  in  participating  in  the  air  cargo 
industry.  While  a  majority  of  these  data  collection  efforts  relies  on  the  voluntary 
submission  of  business  and  employee  information,  the  ability  to  participate  in  the 
aviation  industry  is  contingent  on  this  voluntary  data  submission. 


U.S.  Government  Accounting  Office,  Aviation  Security,  Additional  Actions  Needed  to  Meet 
Domestic  and  International  Challenges. 
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The  first  tier  of  data  eolleetion  in  this  multi-layered  system  is  the  Indirect  lAC 
program.  This  program  allows  those  persons  or  entities  within  the  United  States  who  do 
not  have  a  FAA  air  carrier  certificate  to  indirectly  participate  in  the  transportation  of 
property  on  passenger  air  carriers. The  lACMS  and  the  KSMS  support  this  program  by 
validating  new  and  existing  lACs.  This  database  allows  companies  to  voluntary  submit 
corporate  and  employee  information,  which  is  used  to  mitigate  the  threat  of  a  terrorist 
attack  by  keeping  potentially  dangerous  applicants  and  business  owners  out  of  the 
aviation  industry.  Specifically  within  the  air  cargo  industry,  this  process  is  accomplished 
by  conducting  an  aviation  worker  STA,  as  depicted  in  the  below  figure,  for  employees 
who  want  to  be  employed  in  the  aviation  industry  by  processing  and  shipping  air  cargo. 


Enrollment _ 

Applicants  pay  an  enrollment  fee  and  submit  biographic  (name,  address,  etc.)  and  biometric  information, 
as  applicable  by  program  (photo,  if  applicable,  and  fingerprints)  to  TSA. 

Transportation  Worker  Identification  Hazardous  Materials  Endorsement  (HME): 

Credential  (TWIC);  Depending  on  the  state  from  which  an  application 

Applicant  provides  biographic  and  biometric  is  being  made,  applicant  provides  biographic  and 

information  at  one  of  136  TWtC  enrollment  biometnc  information  to  either  TSA  enrollment 

centers  information  routed  and  screened  on  sites  or  state-designated  sues,  which  transmit 

TSA  Consolidated  Screening  Gateway  system  applications  to  TSA.  Information  routed  and 

screened  on  TSA  Screening  Gateway  system 


_  Adjudication  Center  security  threat  assessment  process 


Preliminary  determination 
of  ineligibility  letter  sent 
to  applicant 

Applicant  may  not  be  eligible 
for  credential 

I 

May  seek  redress” 


_ Credential  issuance _ 

TWIC  HME  Aviation  Worker 

TSA  issues  TWIC  State  licensing  agency  Airport  issues  access 

to  applicant  issues  HME  to  applicant  badge  to  employee 


Source  GAO  analysis  of  TSA  inrormatwii 

Figure  5.  TSA  Functions  in  Security  Threat  Assessment  Process92 
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Transportation  Security  Administration,  “Frequently  Asked  Questions,”  n.d.,  http://www.tsa.gov/ 
stakeholders/frequently-asked-questions- 1 . 

92  U.S.  Government  Accountability  Office,  Report  to  the  Ranking  Member,  Committee  on  Homeland 
Security,  House  of  Representatives,  Transportation  Security,  Action  Needed  to  Strengthen  TSA ’s  Threat 
Security  Assessment  Process  (GAO-13-629),  Washington,  DC:  GPO,  2013,  http://www.gao.gov/assets 
/660/656051.pdf 
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As  an  additional  means  of  securing  the  air  cargo  industry,  the  KSMS  was  created. 
The  KSMS  system  is  a  platform  that  again  allows  for  the  voluntary  submission  and 
collection  of  shipper  information  as  a  means  of  validating  the  legitimacy  of  a  shipper. 
According  to  data  provided  by  the  TSA,  as  of  the  third  quarter  of  2008,  the  TSA  had 
vetted  1.4  million  shippers  through  the  KSMS  system. ^3  a  KSMS  participant  is  granted 
the  ability  to  deliver  cargo  for  transport  on  an  aircraft  to  a  CCSP  participant.  The  CCSP  is 
required  and  able  to  verify  the  known  shipper’s  information  in  the  KSMS,  and  after 
having  successfully  verified  the  validity  of  the  shipper,  is  then  allowed  to  accept  the 
shipment  for  security  screening  and  eventual  shipment  on  air  passenger  aircraft. 

The  TSA  and  its  Office  of  Intelligence  (TSA-OI)  are  responsible  for  the  collection 
and  appropriate  dissemination  of  intelligence  products  to  transportation  stakeholders. 
While  the  TSA-OI  does  not  gather  intelligence,  it  does  receive  information  from  the 
Intelligence  Community  (IC)  that  it  uses  for  threat  analysis.  The  TSA-OI  also  gathers 
information  from  outside  the  IC.  These  information  sources  include  components  of  DHS, 
local  law  enforcement  agencies,  as  well  as  industry  and  transportation  sector  owners  and 
operators.  94  The  TSA-OI  creates  intelligence  products  shared  throughout  the 
transportation  network  as  a  means  of  improving  domain  and  threat  awareness.  The  TSA’s 
regulatory  division  also  uses  these  products,  which  is  responsible  for  using  the 
information  for  determining  the  necessity  of  instituting  Security  Directives  (SD)  to  U.S. 
transportation  system  owners  and  operators  as  a  means  of  mitigating  risks  in  the 
transportation  systems. 

The  TSA’s  multi-layered  system  of  data  collection,  intelligence  products,  and 
threat  assessments  works  well  within  the  United  States  as  a  means  of  mitigating  the  risks 
associated  with  the  transportation  of  domestic  air  cargo.  Although  the  data  collection  is 
voluntary,  it  is  necessary  for  companies  and  employees  to  provide  the  information  if  they 
wish  to  remain  a  competitive  member  of  the  shipping  industry  by  using  passenger 
carrying  aircraft.  Unfortunately,  once  cargo  goes  beyond  the  borders  of  the  United  States, 

93  Transportation  Security  Administration,  “Frequently  Asked  Questions.” 

94  Mark  A.  Randol,  The  Department  of  Homeland  Security  Intelligence  Enterprise,  Operational 
Overview  and  Challenges  for  Congress,  CRS  Report  R40602  (Washington,  DC:  Library  of  Congress, 
Congressional  Research  Service,  March  19,  2010),  http://www.fas.org/sgp/crs/homesec/R40602.pdf 
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the  system  beeomes  ineffective.  Since  the  TSA  does  not  have  the  jurisdictional  authority 
to  enforce  the  application  of  regulations  by  foreign  nations  and  corporations,  it  is  not 
capable  of  requiring  the  data  collection  and  threat  assessment  requirements  on 
international  shipping  corporations  that  transport  air  cargo  until  they  enter  the  United 
States.  Once  an  explosive  device  is  placed  on  an  American  flagged  aircraft,  the  multi¬ 
layered  security  system  has  failed.  The  TSA’s  inability  to  ensure  the  security  of 
international  air  cargo  was  highlighted  by  the  successful  October  2010  AQAP  attack 
printer  toner  attack. 

B,  THE  EUROPEAN  UNION  AIR  CARGO  SYSTEM 

The  goal  of  the  EU  regulations  is  to  harmonize  the  security  procedures  applied  to 
air  cargo  shipments  throughout  the  European  Union  while  minimizing  the  threat  to  EU 
citizens  and  trade.  Similar  to  the  U.S.  domestic  air  cargo  system,  the  European  Union  has 
created  several  categories  of  known  and  secure  shippers  as  a  means  of  ensuring  the 
supply  chains  levels  of  security.  While  some  of  the  processes  differ  from  those  applied 
within  the  United  States,  the  multi-layered  security  framework  used  by  the  European 
Union  nearly  mirrors  that  of  the  United  States. 

The  first  portal  available  for  air  cargo  and  mail  to  enter  into  the  secure  supply 
chain  is  acceptance  by  an  account  consignor,  an  entity  that  serves  as  a  gateway  for 
packages  prior  to  delivery  to  a  known  consignor.  Account  consignors  must  provide 
validated  business  information  to  the  appropriate  member  state  approving  authority.  Once 
accepted,  account  consignors  are  placed  into  a  database  and  the  businesses  shipping 
activity  is  monitored  to  ensure  the  facility  continues  to  process  air  cargo  and  mail 
consignments  appropriately  and  regularly.  If  no  activity  occurs,  the  account  consignor  is 
removed  from  the  database  and  prohibited  from  processing  air  cargo  and  mail 
consignments.  As  described  in  the  EU  air  cargo  security  documents,  “The  EU  security 
regime  relating  to  air  cargo  is  essentially  based  on  two  pillars;  the  secure  supply  chain 
and  the  security  control  of  consignments. 


European  Union,  “European  Commission-MEMO/10/545,  Air  Cargo  Seeurity,”  May  11,  2010, 
http://europa.eu/rapid/press-release_MEMO-10-545_en.htm. 
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The  first  layer  of  security  placed  over  the  airmail  and  cargo  supply  chain  is  the 
regulated  agent,  which  is  defined  as  “any  entity  that  applies  security  controls  as  referred 
to  in  point  6. 3. 2.0.”^^  Member  states  are  required  to  establish  a  verifiable  approval 
process  that  allows  for  the  establishment  of  regulated  agents  within  the  member  states 
civil  aviation  security  program  as  outlined  in  Article  10  EC  300/2008.  Companies  that 
forward  and  haul  freight  are  required  to  meet  and  certify  compliance  with  the  strict 
training  and  documentation  standards  imposed  by  the  EC  300/2008.  These  regulatory 
mandates  require  enhanced  training  standards,  and  as  in  the  United  States,  background 
checks  for  employees  are  similar  to  TSA’s  STA  process.  As  a  result,  those  companies 
that  produce  cargo  and  are  capable  of  meeting  these  standards  are  then  recognized  as  a 
known  consigner,  which  exempts  the  company  from  additional  security  screening  when 
providing  air  cargo  to  a  regulated  agent  for  transportation  on  air  passenger  and  all  air 
cargo  aircraft.9^  This  process  is  illustrated  in  the  below  figure  which  provide  a  visual 
depiction  of  the  European  Union  3^‘^  country  security  processes. 


Official  Journal  of  the  European  Union,  Commission  Regulation  (EU)  N.  185/2010,  March  4,  2010. 
European  Union,  “European  Commission-MEMO/10/545,  Air  Cargo  Security.” 
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Figure  6.  European  Union  3rd  County  Airport  Processes 


Unlike  within  the  United  States,  the  European  Union  does  not  have  a  singular 
police  mechanism  beyond  the  member  states’  borders,  with  the  exception  of  International 
Criminal  Police  Organization  (INTERPOL),  whose  mission  is  to  provide  help  and 
guidance  to  law  enforcement  organizations  by  providing  investigative  training  and 
guidance,  as  well  as  secure  communication  and  communication  channels. ^9  All  other 
intelligence  and  criminal  investigative  responsibilities  fall  to  the  member  states’  military, 
border  police,  or  national  police.  Each  member  state  is  responsible  for  providing  funding 
and  operational  guidance  to  these  law  enforcement  organizations  and  often  allocates 


9^  Directorate  General  for  Internal  Policies,  The  EU Regulatory  Framework  Applicable  to  Civil 
Aviation  Security,  2011. 

99  Interpol,  “Organization  Overview  and  Mission,”  n.d.,  http://www.interpol.int/About- 
INTERPOL/Overview. 
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operation  resources  based  upon  the  threat  guidance  provided  by  the  member  state’s 
intelligence  organization, 

In  much  the  same  manner  that  the  TSA  is  limited  to  regulating  air  cargo 
operations  within  the  jurisdictional  boundaries  of  the  United  States,  the  European  Union 
is  only  capable  of  enforcing  its  jurisdictional  authority  on  those  countries  members  of  the 
European  Union,  which  is  at  an  additional  disadvantage  when  it  comes  to  law 
enforcement  and  intelligence  operations.  Each  EU  member  state  of  is  solely  responsible 
for  law  enforcement  and  intelligence  operations  within  those  states  borders.  While  the 
TSA  as  a  federal  organization  within  the  United  States  has  the  authority  to  mandate  the 
coordinated  dissemination  of  threat  information,  member  states  within  the  European 
Union  are  only  required  to  follow  and  implement  EU  regulations  within  their  means  and 
capabilities  and  may  “derogate  from  the  common  standards  to  adopt  alternative  measures 
providing  an  ‘adequate’  level  of  aviation  security. The  European  Union  has  the  right 
to  conduct  civil  aviation  inspections  as  a  means  of  ensuring  regulatory  compliance  by  the 
member  state.  As  highlighted  in  the  U.S.  system,  compliance  to  the  air  cargo  regulatory 
framework  is  limited  to  members  of  the  European  Union,  which  is  incapable  of  enforcing 
these  regulatory  requirements  on  non-members  that  participate  in  the  air  cargo  industry. 

C.  THE  PROPOSED  AIR  CARGO  POLICY  CHANGE 

It  is  recommended  that  the  TSA,  in  combination  with  CBP,  use  the  Department  of 
State’s  (DOS)  Intelligence  and  Threat  Analysis  (ITA)  sections  protocols  as  the  basis  for  a 
first  level  evaluation  of  risk  for  air  passenger  and  all  cargo  aviation  shipments.  Since 
industry  and  employee  data  cannot  be  gathered  as  a  means  of  conducting  a  STA,  the  DOS 
ITA  can  serve  as  a  vital  bridge  between  the  DOS  and  the  IC  by  producing  real  time 
country  level  threat  and  trend  analysis.  The  ITA  is  able  to  produce  this  analysis  through 
the  creation  and  administration  of  the  Security  Environment  Threat  Eist  (SETL),  which 


U.S.  General  Accounting  Office,  Report  to  Congressional  Requesters,  Combating  Terrorism,  How 
Five  Foreign  Countries  Are  Organized  to  Combat  Terrorism. 

101  Directorate  General  for  Internal  Policies,  The  EU  Regulatory  Framework  Applicable  to  Civil 
Aviation  Security. 
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provides  an  analytical  view  of  four  threat  and  security  categories.  1*^2  of  the  products 
provided  to  the  public  include  DOS  travel  alerts  designed  to  provide  security  guidance  to 
travelers,  and  travel  warnings  designed  to  provide  real  time  threat  information  to  citizens 
about  products  that  detail  security  threats  and  travel  restrictions  to  the  American  public. 
A  similar  process  should  be  developed  in  conjunction  with  the  DOS  that  would  allow  for 
regional  and  country  specific  threat  categorization  that  could  be  applied  to  air  cargo 
departing  identified  threat  countries.  This  initial  evaluation  would  provide  an  opportunity 
to  ensure  high-risk  cargo  is  prevented  from  transport  on  air  passenger  aircraft  or  all  air 
cargo  aircraft  at  the  point  of  origin  or  that  a  verifiable  enhanced  screening  technique  is 
applied  to  authorize  the  transport  of  air  cargo  from  the  threat  region  is  authorized  on  air 
passenger  and  air  cargo  aircraft. 


u.S.  Department  of  State,  Diplomacy  in  Action,  “Intelligence  and  Threat  Analysis,”  2013, 
http://www.  state. govv/m/ds/terrorism/c8584.htm. 
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VI.  JURISDICTIONAL  HURDLES 


The  difficulty  with  coordinating  transnational  terrorism  investigations  and 
operations  has  been  well  documented  in  the  media,  government  reports,  and  academic 
publications.  The  Wall  Street  Journal  focused  on  these  difficulties  in  an  2010  article  that 
detailed  the  security  gaps  and  used  the  below  illustration  to  highlight  the  international 
security  failures.  This  chapter  focuses  on  the  implementation  issues  faced  by  the  TSA  as 
it  pertains  to  verifying  and  enforcing  the  implementation  of  the  100  air  cargo-screening 
requirement.  The  established  processes  of  the  United  States  and  the  European  Union  is 
discussed  and  each  system’s  capabilities  and  limitations  are  explored.  Additionally,  a 
discussion  of  the  possible  difficulties  and  benefits  of  implementation  of  the  proposed 
system  are  evaluated. 


Weak  Links  in  the  Cargo  Chain 


SHIPPERS 

The  Transportation  Security  Admin¬ 
istration  relies  on  'trusted  shippers' 
to  screen  cargo  before  it  gets  on  an 
aircraft. 

There  are  four  methods  approved 
by  the  TSA: 

I  Explosives  detection 
I  X-rays 

I  Physical  inspections 
I  Inspections  by  canine  teams 


100%  of  all  cargo  on  U  S.  domestic  and  international 
passenger  flights  departing  from  the  U.S.  is  now 
being  screened. 


Weak  point: 

There's  no  approved  technology 
to  screen  cargo  ofKe  it  is  loaded 
on  the  pallets  used  to  ship 
cargo  in  wide-body  aircraft 
That  makes  up  75%  of 
passenger  plane  cargo. 


Weak  points: 

Only  about  three-quarters  of  the  cargo  that  currently 
arrives  in  the  U5.  each  day  in  foreign  passenger  jets 
is  screened  or  randomly  inspected  for  explosives 

Among  all  cargo  airaaft  the  amount  of  shipments 
screened  before  they  touch  down  in  the  U.S.  may  be 
as  low  as  50%.  according  to  industry  professionals. 


Figure  7.  Weak  Links  in  the  Air  Cargo  Chain  1^3 


103  Andy  Pasztor,  Keith  Johnson,  and  Daniel  Michaels,  “Focus  on  Cargo  Security  Steps,”  The  Wall 
Street  Journal,  November  1,  2010,  http://onhne.wsj.eom/article/SB1000142405274870370840457558 
6811087404960.html. 
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A. 


THE  U.S.  AIR  CARGO  SYSTEM 


According  to  the  Implementing  the  9/11  Commission  Recommendations  Act  of 
2007,  all  air  cargo  transported  on  passenger  aireraft  is  required  to  reeeive  seeurity 
sereening  at  a  level  eommensurate  with  the  sereening  provided  to  passenger  baggage.  In 
aeeordanee  with  the  Implementing  Recommendations  of  the  9/11  Commission  Act  of 
2007,  the  100  pereent  sereening  proeess  for  domestie  eargo  on  passenger  aireraft  was  to 
be  completed  by  August  2010.  The  ISA,  through  ATSA,  is  tasked  with  regulating  the 
sereening  of  passengers  and  eargo.  This  requirement  is  further  eodified  in  49  CFR  Part 
1542 — Airport  Seeurity,  whieh  outlines  the  regulatory  relationship  between  the  TSA  and 
airport  operators.!*’^  To  meet  this  requirement,  the  TSA  developed  and  implemented  a 
layered  seeurity  methodology  for  the  vetting  and  sereening  of  domestie  and  international 
eargo  shipments  in  the  air  eargo  supply  ehain.  The  goals  of  these  programs  are  detailed  in 
the  TSA  Air  Cargo  Strategie  Plan,  whieh  states  the  priorities  as:  1)  enhaneing  supply 
ehain  and  shipper  seeurity,  2)  identifying  elevated  risk  eargo  through  pre-sereening,  3) 
identifying  technology  for  performing  targeted  inspections,  and  4)  securing  all-cargo 
aircraft  through  the  appropriate  applieation  of  seeurity  measures.  1^6  Cargo  operations  are 
regulated  under  49  CFR  Part  1544.205 — Aeeeptanee  and  Sereening  of  Cargo,  whieh 
states  that  aireraft  operators  are  responsible  for  preventing  the  earriage  of  explosives  in 
cargo  onboard  aircraft  and  how  this  should  be  aeeomplished. 

As  for  international  air  eargo  security,  since  the  TSA  has  no  authority  to  place 
regulatory  restrictions  upon  the  foreign  nation’s  shippers  as  a  means  of  seeuring  the  air 
eargo  supply  chain,  enforcement  of  the  100  percent  air  cargo  screening  requirement  has 
been  diffieult.  As  a  means  of  bridging  this  gap,  the  TSA  has  signed  agreements  with  the 
European  Commission,  Canada,  Australia,  and  the  member  states  of  the  European  Union. 
The  goal  of  these  agreements  is  to  elose  the  gap  in  international  praetiees  by  harmonizing 

Govytrack.us.,  “S.  1447  (107th):  Aviation  and  Transportation  Security  Act.” 

U.S.  Government  Printing  Office,  “49  CFR  Part  1542-Airport  Security.” 

106  Transportation  Security  Administration,  Cargo  Security  Sensitive  Security  Identification  Guide, 
SSIIDG  0050  Version  1.0,  May  2007. 

U.S.  Government  Printing  Office,  “49  CFR  Part  1544.205-Aircraft  Operator  Security:  Air  Carriers 
and  Commercial  Operators.” 
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the  air  cargo  security  practices  beyond  U.S.  borders.  The  TSA  states  on  its  air  cargo 
frequently  asked  questions  website,  “this  harmonization  will  greatly  contribute  to 
achieving  the  100  percent  screening  requirement  of  the  9/11  Act.”i08  These  agreements 
were  necessary  because,  as  stated  by  the  Honorable  Charles  W.  Dent  from  Pennsylvania 
during  his  June  30,  2010  Congressional  testimony,  “International  enforcement  is,  very 
frankly,  impossible.”  and  despite  this  proclamation  went  on  to  say,  “as  the  Ranking 
Member  of  the  subcommittee  that  oversees  TSA,  I  am  going  to  ensure  compliance  with 
the  law. ”109  Despite  the  industries’,  governments’  and  congressional  acknowledgment  of 
the  improbability  of  a  successful  execution  of  the  100  percent  air  cargo  screening 
protocol,  the  requirement  continues  to  exist. 

The  TSA’s  alternative  plan  for  resolving  the  jurisdictional  conflicts  associated 
with  international  compliance  is  dependent  on  raising  the  airlines  screening  requirements 
while  continuing  to  work  with  foreign  governments  to  create  and  certify  compliant  air 
cargo  screening  capabilities  and  inspection  processes,  no  While  within  the  United  States 
the  TSA  is  able  to  enforce  air  cargo  screening  requirements  through  the  employment  of 
TSI-C,  enforcement  operations  and  inspections  outside  of  the  TSA’s  jurisdiction,  is 
dependent  on  the  responsible  governments  and  associated  agencies,  m  As  a  result  of 
these  jurisdiction  difficulties,  John  Meenan,  the  Chief  Operating  Officer  of  the  Air 
Transport  Association,  stated  in  his  congressional  testimony  that  “the  most  practical 
approach  internationally  rests  with  the  approval  of  government-to-government 
compatible  security  programs.”  Multinational  collaboration  and  cooperation  is  always 
difficult  to  accomplish  in  an  open  trade  environment.  This  issue  additionally  includes  the 
necessity  to  gain  and  verify  regulatory  compliance  from  domestic  and  foreign  air  carriers, 
as  well  as  the  governments  of  foreign  countries.  The  review  and  acceptance  of  air  carrier 
security  programs  dates  as  early  as  1990  when  the  Presidential  Commission  on  Aviation 

108  Transportation  Security  Administration,  “Frequently  Asked  Questions.” 

Dent,  “100  Percent  Air  Cargo  Screening:  Remaining  Steps  to  Secure  Passenger  Aircraft,  Flearing 
before  the  Subcommittee  on  Transportation  Security  and  Infrastructure  Protection.” 

110  Ibid. 

111  Ibid. 

112  Ibid. 
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Security  and  Terrorism  first  explored  and  addressed  the  issue  in  the  wake  of  the  attack  on 
Pan  Am  flight  103. Despite  the  continued  effort  to  harmonize  security  processes  and 
procedures  internationally,  enforcement  and  regulation  continue  to  prevent  an 
administratively  acceptable  solution. 

B,  THE  EU  AIR  CARGO  SYSTEM 

The  EU  regulatory  framework  applies  to  all  its  member  states  and  is  updated 
regularly  to  ensure  the  member  states’  ability  to  address  evolving  risks  and  threats,  As 
such,  these  member  states  are  required  to  ensure  the  security  of  flights  departing  their 
territories.  In  response  to  the  attacks  on  9/11,  the  European  Union  passed  regulation 
2320/2002  that  established  the  EU’s  aviation  security  goals.  As  stated  in  2320/2002,  “The 
main  objective  of  this  Regulation  is  to  establish  and  implement  appropriate  Community 
measures,  in  order  to  prevent  acts  of  unlawful  interference  against  civil  aviation.”! 
Eurthermore,  the  European  Union  established  Commission  Regulation  (EC)  No  622/2003 
on  4  April  2003,  which  establishes  measures  for  the  implementation  of  the  common  basic 
standards  on  aviation  security,  the  majority  of  which  are  appropriately  classified  at  the 
secret  level. Just  as  49  CER  1550  established  the  authority  of  the  TSA  to  regulate 
aviation  within  the  United  States,  EC  622/2003  was  designed  to  “lay  down  the  necessary 
measures  for  the  implementation  and  technical  adaptation  of  common  basic  standards 
regarding  aviation  security  to  be  incorporated  into  national  civil  aviation  security 
programs.”!!^  As  the  aviation  industry  and  associated  regulatory  organization  began  to 
focus  on  preventing  dangerous  and  hazardous  cargo  from  being  transported  on  air 
passenger  aircraft,  the  EU  Council  published  EC  831/2006  that  states: 


!  !3  PolicyFutures,  “Report  of  the  Presidents  Commissions  on  Aviation  Security  and  Terrorism,”  34. 

!  Directorate  General  for  Internal  Policies,  The  EU  Regulatory  Framework  Applicable  to  Civil 
Aviation  Security. 

!  Official  Journal  of  the  European  Union,  “Commission  Regulation  (EC)  No  2320/2002  of  16 
December  2002,”  2002,  http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?urUOJ:L:2002:355:0001: 
0021:EN:PDF. 

116  Official  Journal  of  the  European  Union,  “Commission  Regulation  (EC)  No  622/2003  of  4  April 
2003.” 

117  Ibid. 


48 


(3)  As  regards  the  measures  for  the  implementation  of  the  standards  on 
airline  materials  and  on  eargo,  eourier  and  express  pareels,  the  eontent  of 
Regulation  (EC)  No  622/2003  should  be  revised  in  the  light  of  experienee 
gained. 

Similar  to  the  proeess  employed  in  the  United  States  by  the  TSA,  the  European 
Commission  is  responsible  for  the  monitoring  of  the  member  states  to  ensure  eomplianee 
with  the  regulation.  This  monitoring  is  aeeomplished  with  unannouneed  regulatory 
inspeetions  and  enforeement  operations.  Member  states  are  required  to  eomply  with  the 
inspeetions  and  to  make  auditors  available  for  partieipation  in  the  inspeetion.  As  with  the 
TSA,  when  it  eomes  to  third-eountry  shippers,  the  European  Union  also  does  not  have  the 
neeessary  regulatory  authority  to  require  eomplianee  with  the  EU  regulations.  As  a  result, 
the  European  Union  seeks  eooperation  from  third  eountries  through  the  aeeeptanee  of 
seeurity  praetiees  and  standards  as  way  to  “faeilitate  air  transport  and  eontribute  to  the 
objeetive  of  ‘on-stop-seeurity’”  by  reeognizing  “the  equivalenee  of  aviation  seeurity 
standards  of  third  eountries.”  i^o  Similar  to  the  eoneerns  faeed  by  the  United  States,  when 
it  eomes  to  aeeepting  the  proeess  and  proeedures  of  a  foreign  nation,  the  European  Union 
does  not  have  the  eapability  to  regulate  or  enforee  seeurity  protoeols  outside  its 
jurisdietional  boundaries,  whieh  hinders  the  ability  to  verify  the  aeeeptability  of  the  third- 
eountries  protoeols. 

C.  THE  PROPOSED  AIR  CARGO  POLICY 

Unfortunately,  no  good  solutions  are  available  to  the  jurisdietional  gaps  that  exist 
at  the  point  in  whieh  international  trade  and  government  regulation  interseet.  The 
proposed  system  of  evaluating  international  air  eargo  is  no  different  from  the  EU  or  the 
U.S.  system  in  this  shorteoming.  The  ability  of  a  foreign  eountry  to  attempt  to  enforee  its 
regulatory  authority  upon  a  seeondary  eountry  is  simply  implausible.  Without  the  ability 


1 1  ^  Official  Journal  of  the  European  Union,  “Commission  Regulation  (EC)  No  83 1/2006  of  2  June 
2006,”  2006,  http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2006:l 50:0004:0005 :EN:PDF. 

119  European  Parliament,  “The  EU  Regulatory  Framework  Applicable  to  Aviation  Security,”  2011, 
http  ://www.  eroparl.europa.eu/ studies. 

120  Ibid. 
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to  impose  fiscal  or  operational  penalties  on  the  regulated  industry  or  country,  the 
authority  of  the  regulating  agency  is  significantly  diminished. 

The  one  possible  solution  to  a  failure  of  a  foreign  country  to  comply  with  the 
screening  requirements  that  could  be  imposed  is  that  used  by  CBP  when  passengers  are 
brought  into  the  United  States  without  the  appropriate  visas  or  authorizations.  CBP 
regularly  requires  international  air  carriers  to  pay  for  the  cost  of  returning  foreign 
nationals  to  their  point  of  departure  if  they  arrive  in  the  United  States  without  the  proper 
documentation,  visas,  or  authorizations.  Applying  this  process  to  air  cargo  that  arrives  in 
the  United  States  without  having  been  appropriately  screened  prior  to  departure  from  the 
point  of  origin  would  provide  a  fiscal  incentive  for  the  air  carrier  to  ensure  the 
appropriate  processes  and  procedures  were  followed  prior  to  transport.  While  not  an 
effective  prevention  or  detection  solution,  it  does  provide  a  fiscal  motivation  for  the 
airline  to  comply  with  the  screening  protocols. 
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VII.  AIR  CARGO  SECURITY  SYSTEM  COSTS 


Many  hurdles  to  the  implementation  of  a  100  percent  air  cargo  screening  protocol 
exist.  One  of  the  most  often  cited  and  documented  hurdles  noted  in  government  and 
industry  reports  are  the  costs  associated  with  this  requirements  implementation.  The 
application  of  this  process  in  an  international  environment  further  exacerbates  the  costs 
associated  with  its  implementation  because  of  the  varied  protocols,  technologies,  and 
capabilities  in  the  affected  countries.  The  journal  of  the  European  Union  used  the  below 
scales  of  justice  as  a  means  of  providing  a  visual  depiction  of  the  trade  offs  associated 
with  increased  security  and  the  effects  these  increases  have  on  trade.  This  chapter 
explores  the  projected  costs  associated  with  the  implementation  of  the  100  percent  air 
cargo  screening  protocol  for  the  United  States  and  the  European  Union,  and  the  projected 
savings  of  implementing  a  risk-based  intelligence  driven  system. 


Security 

Threats 

*  Explosives  and  Incendiary 
devices 

*  Hazardous  materials 

*  Cargo  crime 

*  Sabotage 

Measures 

*  Screening 
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A.  THE  AIR  CARGO  SYSTEM 

The  air  cargo  industry  is  designed  to  provide  fast  and  efficient  transportation  of 
consumer  products  across  the  global  supply  chain.  Since  the  air  cargo  industry  is  such  a 


121  Official  Journal  of  the  European  Union,  “Commission  Regulation  (EC)  No  1802/2012  of  9 
November  2012,”  2012,  http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2012:324: 
0025:0049:EN:PDF. 
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diverse  organization  that  regularly  erosses  international  boundaries,  it  is  diffieult  to 
accurately  assess  the  economic  impact  the  100  percent  air  cargo  screening  requirement 
will  have  on  the  affected  economies  and  the  industry.  It  is  further  more  difficult  to 
separate  the  economic  impact  the  mandate  will  have  on  both  the  U.S.  and  EU  economies 
without  discussing  them  simultaneously.  Instead  of  attempting  to  accomplish  this  task, 
this  chapter  examines  the  cumulative  impact  the  regulatory  change  will  have  on  the 
economies  and  industry  concurrently. 

In  2011,  air  cargo  merchandise  transportation  accounted  for  an  estimated 
$424,265  million  in  U.S.  exports  and  $493,038  million  in  U.S.  imports. ^22 
Comparatively,  the  European  Union  had  air  trade  imports  valued  at  292.1  billion  euros 
and  exports  valued  at  362  billion  euros  during  2010.^23  in  2010,  air  passenger  aircraft 
operators  alone  transported  an  estimated  3.6  billion  pounds  of  air  cargo  to  the  United 
States  from  foreign  points  of  origin.  124  jn  testimony  before  Congress  in  2010,  John 
Sammon,  Assistant  Administrator  of  TSA,  stated  that  an  estimated  “2.8  billion  pounds  of 
air  cargo  arrives  on  passenger  aircraft  from  94  different  sovereign  nations  annually  via  a 
global  air  cargo  supply  chain  with  a  vast  number  of  participants.”  125  Anytime  a  universal 
requirement  is  placed  on  such  a  vast  and  complex  industry  that  contains  such  a 
widespread  group  of  stakeholders,  it  is  difficult  to  predict  the  unintended  costs  and 
consequences. 

The  implementation  of  the  100  percent  air  cargo  security  screening  mandate  cost 
was  estimated  by  the  Center  for  American  Progress  in  a  2007  study  to  be  at  least 
$600  million  annually  for  the  air  cargo  shipping  industry.  According  to  the  International 

122  Vivian  C.  Jones  and  Marc  R.  Rosenblum,  U.S.  Customs  and  Border  Protection:  Trade 
Facilitation,  Enforcement  and  Security,  CRS  Report  R43014  (Washington,  DC:  Library  of  Congress, 
Congressional  Research  Service,  March  22,  2013),  39. 

123  Official  Journal  of  the  European  Union,  “Commission  Regulation  (EC)  No  1802/2012  of  9 
November  2012,”  9. 

^24  U.S.  Government  Accountability  Office,  Report  to  Congressional  Requesters,  Aviation  Security, 
Actions  Needed  to  Address  Challenges  and  Potential  Vulnerabilities  Related  to  Securing  Inbound  Air 
Cargo  (GAO-12-632),  Washington,  DC:  GPO,  2012,  http://www.gao.gov/products/GAO-12-632. 

125  John  Sammon,  “100  Percent  Air  Cargo  Screening:  Remaining  Steps  to  Secure  Passenger  Aircraft. 
Hearing  before  the  Subcommittee  on  Transportation  Security  and  Infrastructure  Protection,”  2010, 
http://www.gpo.gov/fdsys/pkg/CHRG-l  1  ll^rg64699/html/CHRG-l  1  lhhrg64699.htm. 
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Air  Cargo  Council,  imposing  the  100  percent  air  cargo  screening  mandate  creates 
“additional  cost  burdens  on  the  U.S.  economy,  negatively  impacting  businesses — both 
small  and  large — ^with  the  establishment  of  cargo  security  and  inspection  protocols  that 
rely  on  unproven  technologies  and  that  do  not  insure  security  improvements  that  are 
commensurate  with  the  expenses  incurred.” ^26  in  2007,  TSA  spokeswoman  Andrea 
McCauley  estimated  that  the  10-year  cost  of  implementing  the  100  percent  air  cargo¬ 
screening  mandate  would  be  approximately  $3.6  billion  while  a  CRS  analysis  similarly 
placed  the  implementation  costs  at  approximately  $3.7  billion  over  the  same  10-year 
period.  127  in  his  2007  testimony  before  the  subcommittee  on  transportation,  Pennsylvania 
Congressman  Charles  Dent  discussed  the  cost  of  the  100  percent  air  cargo-screening 
mandate  when  he  said  the  measure  “placed  an  expensive  and  burdensome  mandate 
without  adding  any  tangible  security  benefit.”  128 

The  application  of  the  100  percent  air  cargo  screening  protocol  also  creates 
government  costs.  As  early  as  2001,  the  FAA  conducted  an  analysis  to  determine  the 
feasibility  and  cost  of  screening  all  passenger  air  cargo.  The  FAA  analysis  determined 
that  to  accomplish  the  100  percent  passenger  air  cargo  screening  goal,  8000  federal  air 
cargo  screeners  would  be  required,  and  a  budget  of  $500  million  would  be  necessary  to 
create  the  cargo  inspection  program.  Today,  the  TSA’s  Transportation  Sector  Network 
Management  Air  Cargo  Divisions  2011  budget  was  $115  million.  These  funds  were  used 
to  support  air  cargo  inspections,  explosive  canine  operations  and  the  National  Explosives 
Detection  Canine  Program.  129  in  Senate  Report  1 12-074,  which  details  the  appropriations 
for  TSA’s  security  programs,  the  112th  Congress  allocated  $120,654,000  for  air  cargo 


126  Peny  Trunick,  “Opposition  Gathers  to  H.R.  1  Security  Regulations,”  Material  Handling  & 
Logistics,  2007,  http://mhlnews.com/transportation-amp-distribution/opposition-gathers-hr-l-security- 
regulations. 

127  Bart.  Air  Cargo  Security. 

128  Dent,  “100  Percent  Air  Cargo  Screening:  Remaining  Steps  to  Secure  Passenger  Aircraft.  Hearing 
before  the  Subcommittee  on  Transportation  Security  and  Infrastructure  Protection.” 

129  U.S.  Government  Accountability  Office,  Report  to  Congressional  Requesters,  Aviation  Security, 
Actions  Needed  to  Address  Challenges  and  Potential  Vulnerabilities  Related  to  Securing  Inbound  Air 
Cargo,  11. 
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security  activities,  This  number  represented  a  6,000,000  dollar  increase  beyond  the 
funds  requested  which  represented  targeted  funding  designed  to  secure  all  air  cargo 
aircraft  and  facilities,  as  well  as  international  air  cargo  being  transported  on  inbound  air 
passenger  aircraft.  Similar  to  the  government  and  industry  analysis  and  projected  costs 
that  have  been  broadly  discussed  and  cited  regarding  the  U.S.  implementation  of  the  100 
percent  air  cargo  security  requirement,  the  EU’s  implementation  process  faces 
comparable  costs  and  challenges.  In  an  EU  Commission  sanctioned  report  on  the 
implementation  of  the  new  screening  requirements,  an  analysis  of  the  incurred  costs 
based  upon  the  percentage  of  cargo  screened  determined  that  at  a  45  percent  screening 
level  assuming  a  .025  Euros  surcharge  per  kilo,  the  accumulated  screening  cost  would  be 
38.3  million  Euros. A  surcharge  of  .05  would  raise  the  estimate  to  85.3  million  Euros. 
Additionally,  the  initial  cost  for  the  training  and  certification  of  166  EU  aviation  security 
validators  would  be  approximately  1.5  million  Euros.  1^2  The  report  continued  to  note  that 
if  the  number  were  raised  to  401  EU  aviation  security  validators,  the  cost  would  jump  to 
2.8  million  Euros.  133 

The  balance  between  security  and  an  unencumbered  industry  is  a  difficult 
pathway  to  navigate.  Determining  at  what  point  the  cost  of  a  process  exceeds  the  benefit 
the  added  security  provides  has  been  a  source  of  debate  and  analysis  within  the 
government  and  media  since  the  attacks  on  9/1 1.  In  the  final  analysis,  the  critical  question 
that  needs  to  be  answered  is  whether  the  use  of  100  percent  air  cargo  security  screening, 
which  carries  a  significant  number  of  negative  cost  implications,  is  justified  by  the 
greater  impregnability  of  the  international  air  cargo  supply  chain.  134  While  the 
tremendous  volume  of  air  cargo  combined  with  the  significant  negative  economic  impact 

130  jiie  Library  of  Congress  Thomas,  “Committee  Reports,  1 12th  Congress  (2011-2012)  Senate 
Report  1 12-074,”  http://thomas.loe.gov/egi-bin/epquery/?&sid=epl  125e4Ad&r_n=sr074. 1 12&db 
name=epl  12&&seUTOC_236142&. 

131  Offieial  Journal  of  the  European  Union,  “Commission  Regulation  (EC)  No  1802/2012  of  9 
November  2012,”  7. 

132  Ibid. 

133  Ibid. 

134  Poliey  Researeh  Corporation,  The  Impact  of  100  percent  Scanning  of  U.S.  Bound  Container  on 
Maritime  Transport,  Final  Report,  2009. 
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an  attack  on  the  global  air  cargo  supply  chain  would  have  on  the  U.S.  and  European 
eeonomies  requires  the  pursuit  of  an  improved  air  eargo  security  solution,  the  greater 
question  is  if  the  cost  of  implementing  a  100  pereent  air  eargo  sereening  requirement  is  a 
fiseally  responsible  solution. 

B,  THE  PROPOSED  AIR  CARGO  POLICY 

The  proposed  system  seeks  to  apply  known  and  readily  available  programs, 
systems,  and  data  streams  to  what  are  today  a  splintered  international  air  cargo  security 
process  with  separate  requirements  within  multiple  ageneies.  While  eosts  will  eertainly 
be  assoeiated  with  the  implementation  and  integration  of  these  systems,  the  burden  of  the 
eosts  will  not  be  assoeiated  with  instituting  new  and  untested  systems,  teehnologies,  and 
regulatory  requirements.  The  current  100  pereent  air  eargo  seeurity  sereening  protoeol 
proeess  places  the  eost  on  the  shoulders  of  the  aviation  and  shipping  industries.  Assuming 
a  risk-based  intelligenee  driven  system  has  the  ability  to  reduce  the  required  100  pereent 
air  cargo  screening  by  50  pereent,  and  using  the  Center  for  American  Progress  2007 
study  of  the  air  cargo  shipping  industry  costs  for  implementing  a  100  pereent  air  eargo 
sereening  requirement,  the  proposed  system  has  the  eapability  to  save  the  air  eargo 
industry  approximately  $300  million  annually.  i^SQygj-  ^  decade,  the  possible  reduction 
in  screening  of  low  risk  eargo  has  the  ability  to  translate  into  a  1.5  billion  dollar  savings 
using  the  TSA’s  and  CRS’s  10-year  eost  estimates  for  the  eurrent  system.  136  greater 
benefit  will  be  the  eost  savings  realized  by  the  effieient  use  of  enforeement  and 
regulatory  assets.  While  the  eurrent  system  will  require  that  all  air  eargo  be  treated 
equally,  the  proposed  system  looks  to  target  those  air  eargo  shipments  that  pose  the 
greatest  threat  to  the  aviation  industry  by  assessing  the  risk  of  the  shipment,  shipper, 
region,  and  the  aireraft  type,  and  then  applying  the  appropriate  threat  and  seeurity  level  to 
the  item  that  then  allows  security  and  law  enforcement  speeialists  to  require  or  reduce  the 
sereening  requirement  to  ensure  the  appropriate  use  of  the  limited  seeurity  assets. 


133  p.  J.  Crowley  and  Bruce  R.  Butterworth,  “Keeping  Bombs  off  Planes,  Securing  Air  Cargo, 
Aviation’s  Soft  Underbelly,”  Center  for  American  Progress,  May  2007,  http://www.americanprogress.org/ 
issues|/2007/05/pdf/air_cargo.pdf 

136  Bart.  Air  Cargo  Security. 
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VIII.  RECOMMENDATIONS  AND  CONCLUSIONS 


A.  ADOPTION  OF  A  RISK  BASED  INTELLIGENCE  DRIVEN  AIR  CARGO 

SCREENING  PROTOCOL 

For  the  TSA  to  move  towards  a  risk-based  intelligence  driven  air  cargo  screening 
operation,  a  shift  from  the  100  percent  screening  model  and  mandates  must  be  made. 
CBP  has  historically  conducted  risk-based  and  intelligence  driven  passenger  and  cargo 
operations  out  of  the  National  Targeting  Center  (NTC).  Additionally,  the  TSA  regularly 
applies  risk-based  strategies  to  domestic  and  international  passenger  air  travel  through  the 
use  of  interagency  operations  at  the  NTC  and  risked-based  security  initiatives,  such  as 
TSA  Pre/,  the  under  12  and  over  75  modified  screening  procedures,  and  the  Know 
Crew  Member  Database,  while  maintaining  a  security  randomization  process  that  ensures 
no  passenger  is  exempt  from  the  possibility  of  the  full  security  protocols  as  outlined  in 
the  ATS  A.  TSA’s  Kenneth  Fletcher  provided  the  below  depiction  of  a  risk  based 
passenger  screening  process  in  his  thesis  which  argued  for  the  implementation  of  such  a 
protocol  as  a  means  of  more  efficiently  and  effectively  screening  passengers  in  the 
aviation  domain. 
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Figure  9.  Risk-Based  Screening  137 


The  proposed  policy  change  is  designed  to  create  a  base  line  from  which  the 
program  can  be  established  and  then  expanded.  Each  tier  in  the  process  is  used  as  a  threat 
screening  method  with  the  goal  of  separating  the  cargo  that  poses  the  greatest  real  or 
perceived  threat  from  the  cargo  that  poses  a  lower  threat  to  aviation.  This  process  does 
not  require  the  physical  screening  of  the  cargo  but  rather  is  a  data  driven  procedure  that 
allows  for  the  rapid  separation  of  cargo  into  distinct  threat  levels.  Each  threat  grouping  is 
then  subject  to  the  necessary  level  of  physical  or  administrative  screening  as  opposed  to 
the  now  required  100  percent  screening  mandate. 

The  tiers  are  not  meant  to  remain  as  a  static  screening  mechanism.  The  intent  of 
the  tiered  system  is  to  allow  each  grouping  to  be  adjusted  based  on  a  risk-  and  threat- 
based  intelligence  system.  Each  tier  can  be  rapidly  adjusted  and  adapted  to  the  threat  and 
risk  associated  with  regions,  periods  of  heighten  awareness,  or  parcel  types.  While  the 


137  Kenneth  Fletcher,  “Aviation  Security:  A  Case  for  Risk-Based  Passenger  Screening”  (master’s 
thesis,  Naval  Postgraduate  School,  2011),  http://www.hsdl.org/?view&did=699603. 
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initial  policy  includes  a  three-tiered  system,  it  should  be  seen  as  a  statie  part  of  the  poliey. 
The  proeess  was  developed  with  the  intention  of  ereating  a  flexible,  adaptable,  and 
sustainable  sereening  system.  If  mores  tiers  are  required  to  ensure  the  proper  sereening  of 
air  eargo,  they  should  be  added.  Additionally,  onee  a  tier  is  added,  it  is  not  neeessary  to 
keep  that  tier  indefinitely.  If  the  tier  has  served  it  purpose,  and  is  no  longer  needed 
beeause  a  threat  period  has  passed,  then  when  appropriate,  it  should  be  removed. 

1,  Tier  One 

It  is  reeommended  that  the  TSA  and  CBP  use  the  DOS’s  ITA  seetions  protoeols 
as  the  basis  for  a  first  level  evaluation  of  risk  for  air  passenger  and  all  eargo  aviation 
shipments.  The  DOS  ITA  serves  as  a  vital  bridge  between  the  DOS  and  the  IC,  whieh 
produees  real  time  threat  and  trend  analysis.  The  ITA  ereates  and  administers  the  SETL, 
whieh  provides  an  analytieal  view  of  four  threat  and  seeurity  eategories.^^s  Two  produets 
provided  to  the  publie  inelude  DOS  travel  alerts  designed  to  provide  seeurity  guidanee  to 
travelers,  and  travel  warnings  designed  to  provide  real  time  threat  information  to  eitizens 
in  produets  that  detail  seeurity  dangers  and  travel  restrietions  to  the  Ameriean  publie.  A 
similar  proeess  should  be  developed  in  eonjunetion  with  the  DOS  that  would  allow  for 
regional  and  eountry  speeifie  threat  eategorization  that  eould  be  applied  to  air  eargo 
departing  threat  eountries.  This  initial  evaluation  would  provide  an  opportunity  to  ensure 
high-risk  eargo  is  prevented  from  transport  on  air  passenger  aireraft,  or  all  air  eargo 
aireraft  or  that  verifiable  enhaneed  sereening  teehniques  are  applied  to  authorize  the 
transport  of  air  eargo  from  the  threat  region  on  air  passenger  and  air  eargo  aireraft. 

2.  Tier  Two 

The  TSA  and  CBP  would  eontinue  to  eonduet  assessments  of  domestie  and 
international  eargo  faeilities  for  regulatory  eomplianee  and  would  retain  administrative 
oversight  of  these  publie  entities.  The  TSA  would  ensure  domestie  eomplianee  of 
shippers  with  49  CFR  1542  (Airport  Seeurity  Regulation),  1544  (Domestie  Aireraft 
Operator  Regulation),  and  1546  (Foreign  Air  Carrier  Seeurity),  whieh  detail  the  proeess 


138  U.S.  Department  of  State,  Diplomacy  in  Action,  “Intelligence  and  Threat  Analysis.” 
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for  compliance  with  the  aireraft  operator  standard  security  program,  the  model  security 
program,  and  airport  security  programs  that  detail  the  proeesses  neeessary  to  eomply  with 
the  federal  regulations  pertaining  to  aviation  operations.  The  TSA  and  CBP  would 
eontinue  to  evaluate  the  value  of  the  air  eargo  strategie  plan  and  ACAS  pilot  program  that 
applies  established  threat-based  risk  management  protoeols  to  aviation  eargo  seeurity 
operations.  Additionally,  the  TSA  should  expand  the  known  shipper  program  beyond  the 
400,000+  voluntary  partieipants  ereating  a  mandatory  partieipation  protoeol,  whieh 
would  allow  for  an  inereased  visualization  of  air  eargo  seeurity  operations  and  data 
eollection.  The  larger  the  data  available  for  analysis,  the  stronger  the  program  will 
become.  Effective  data  eolleetion  and  analysis  can  be  best  aecomplished  by  making  a 
eoneerted  effort  to  inerease  the  population  base  available.  Efforts  should  be  increased  to 
improve  industry  participation  in  this  portion  of  the  proeess. 

3.  Tier  Three 

Two  elasses  of  air  cargo  should  be  created.  The  TSA  and  CBP  should 
differentiate  the  threat  posed  by  a  sereening  failure  in  air  eargo  on  passenger  aircraft  and 
air  cargo  on  all  air  cargo  or  all  airmail  aircraft,  as  is  done  in  by  EU  Commission 
Regulation  No  185.2010.  The  implementation  of  a  risk-  and  eonsequenee-based  seeurity 
protoeol  is  eonsistent  with  the  pending  Quadrennial  Homeland  Seeurity  Review.  A  risk 
and  eonsequenee  applieation,  whieh  is  based  on  the  impaet  of  an  attaek  on  eaeh  mode  of 
transportation,  would  provide  the  balanee  desired  by  industry  leaders  and  the  flexibility 
sought  by  the  governing  offieials.  Of  partieular  note  in  EU  Regulation  No  185/2010  is  the 
designation  of  eargo  seeure  for  passenger,  all-eargo,  and  all-mail  aireraft,  and  the 
distinetion  of  eargo  secure  for  all-cargo  and  all-mail  aircraft  only,  based  on  a  known 
consignor  and  the  means  or  method  of  sereening,  which  allows  shippers  the  ability  to 
adjust  sereening  proeess  dependent  on  the  method  of  transport  required.  This 
differentiating  methodology  is  absent  in  the  TSA  and  CBP  proeesses.  The  ability  to 
distinguish  the  eonsequenee  level  based  on  passenger  aireraft  versus  the  all  air  eargo  and 
mail  aireraft  is  a  signifieant  advantage  for  the  European  Union  as  opposed  to  the  all 
threats  all  eonsequenee  inelusive  system  the  United  States  uses  under  the  current  100 

percent  air  eargo  seeurity  sereening  eongressional  mandates. 
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A  group  within  the  NIC  should  be  ereated  with  the  goal  of  developing  a  risk- 
based  sereening  protoeol  that  would  eombine  the  numerous  and  overlapping  programs 
that  eurrently  exist  separately  within  the  TSA  and  CBP  while  eontinuing  to  meet  the 
goals  and  mandates  of  each  agency.  This  group  would  additionally  be  tasked  with 
creating  a  unified  air  cargo  security  plan  and  protocols.  The  application  of  joint 
operations  and  analysis,  a  risk-  and  consequence-based  targeting  system  will  allow  for  an 
extensive  and  multi-dimensional  assessment  of  air  passenger  cargo  and  all  air  cargo 
aircraft  in  the  global  supply  chain  to  limit  terrorist  and  criminal  organizations  from 
capitalizing  on  the  identified  weaknesses  in  these  systems. 

The  TSA  and  CBP  should  formally  combine  cargo  security  targeting  and 
screening  operations  while  seeking  to  have  Congress  shift  the  mandated  operational 
emphasis  away  from  the  100  percent  screening  mandate  and  move  towards  a  risk-  and 
consequence-based  screening  protocol  that  would  provide  a  flexible,  adaptable,  resilient, 
sustainable,  and  balanced  process  that  protects  industry  and  customer  interests  while 
ensuring  a  secure  domestic  and  international  air  cargo  supply  chain. 

B,  CHALLENGES  TO  IMPLEMENTATION 

The  global  supply  chain  is  a  complex  and  continuously  evolving  entity  that  makes 
it  difficult  for  a  single  agency  with  limited  resources  to  ensure  its  security.  A  combined 
effort  to  secure  air  cargo  by  the  TSA  and  CBP  could  provide  the  depth  of  experience  and 
breathe  of  resources  necessary  to  improve  the  current  system,  which  is  both  cumbersome 
and  duplicative.  A  combined  risk-based  intelligence  driven  air  cargo  security  effort 
would  best  accomplish  the  goals  and  mandates  of  the  Aviation  Transportation  Security 
Act  of 2001  and  the  Implementing  Recommendations  of  the  9/1 1  Commission  Act  of 2007. 
The  problem  has  been  recognized  and  well  documented  in  government  reports  and 
testimony,  as  well  as  in  industry  trade  journals. 

Prior  to  and  after  9/11,  the  GAO  and  CRS  conducted  numerous  inquiries  into  the 
air  cargo  supply  chain  and  have  generated  voluminous  reports  that  have  identified  the 
scope  of  the  issue,  the  failures,  and  the  successes  of  both  the  TSA’s  and  CBP’s  air  cargo 
screening.  As  a  result  of  this  failure,  several  process  groups  have  been  created  within  the 
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TSA  and  CBP  that  include  foreign  counterparts  and  industry  leaders  in  the  global  supply 
ehain.  In  eaeh  instance,  the  foeus  has  been  on  the  need  for  eollaboration  and  industry 
participation  to  meet  the  100  pereent  air  eargo  sereening  eongressional  mandates  despite 
the  universal  agreement  that  such  a  process  is  eumbersome  and  inefficient. 

In  2009,  CBP  and  the  TSA  ereated  a  working  group  with  the  intent  of  determining 
the  feasibility  of  using  CBPs  ATS  to  support  the  eargo-sereening  mission  of  the  TSA. 
Following  the  2010  air  eargo  attaek,  the  working  group’s  activities  were  aceelerated  and 
a  voluntary  pilot  program  was  established  to  determine  the  feasibility  of  a  eombined 
eargo  security  effort  between  CBP  and  the  TSA.  1^9  Xo  date,  the  ACAS  pilot,  whieh  was 
extended  this  past  April,  has  been  used  to  evaluate  14  million  shipments  in  the  express 
segment  of  the  air  eargo  system  by  using  available  data  and  shipper  information. 
Although  progress  has  been  made,  the  system  remains  voluntary  and  still  does  not  eover 
all  segments  of  the  air  eargo  supply  ehain,  and  as  a  result,  both  ageneies  failed  to  detect 
the  2010  Yemen  air  eargo  attaek. 

For  the  TSA  to  move  towards  a  risk-based  intelligenee  driven  air  eargo  sereening 
operation,  a  shift  from  the  eongressionally  mandated  100  pereent  sereening  model  would 
be  neeessary.  This  hurdle  will  require  a  repeal  or  modffieation  of  the  legislation  that 
mandates  this  requirement,  whieh  will  be  diffieult  but  not  impossible.  As  previously 
noted,  the  TSA  is  implementing  robust  risk-based  passenger  sereening  protoeols.  The 
move  from  the  100  pereent  all  threat  passenger-sereening  protocols  provides  an 
opportunity  for  the  evaluation  of  the  neeessity  and  feasibility  of  the  100  pereent  air  eargo 
sereening  proeesses.  The  100  pereent  air  eargo  seeurity  screening  protocols  continue  to 
be  developed  despite  the  eompelling  industry  and  governmental  testimony  eiting  the 
fiseal  and  jurisdietional  obstaeles  and  infeasibility  of  applying  sueh  a  regimented  system 
of  seeurity.  An  alternative  solution  to  this  problem  is  to  both  redefine  the  sereening 
proeess  and  to  eombine  the  resourees  of  CBP  and  the  TSA  in  the  ACAS  system.  This 

139  Department  of  Homeland  Seeurity,  “Air  Cargo  Advanee  Screening  (ACAS)  Pilot,”  CBP.gov, 
August  2011,  http://www.cbp.gov/xp/cgov/trade/cargo_security/cargo_control/acasp_faq.xml. 

141*  Transportation  Security  Administration,  “Air  Cargo  2012  Spring  Conference,  TSA  Administrator 
John  S.  Pistole,  Remarks  As  Prepared  for  Delivery,  Air  Cargo  2012  Spring  Conference,  Miami,  Florida, 
March  20,  2012,”  March  20,  2012,  http://www.tsa.gov/press/speeches/air-cargo-2012-spring-conference. 
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process,  in  addition  to  the  three-tiered  system  previously  deseribed,  ean  be  used  to  meet 
the  requirements  imposed  by  the  eongressionally  mandated  100  pereent  sereening 
protoeol  while  eliminating  the  need  to  physieally  inspeet  all  air  cargo. 

CBP  has  historically  applied  risk-based  strategies  to  international  passenger  air 
travel  through  joint  operations  at  the  NTC,  and  the  TSA  has  moved  towards  a  more 
efficient  risk-based  sereening  proeess,  whieh  allows  eaeh  agency  to  allocate  the  defined 
and  limited  resourees  properly  that  have  beeome  the  reality  of  the  currently  restrieted 
government  operations  eycle. 

C.  LIMITATIONS  OF  THE  RESEARCH 

This  projeet  was  begun  as  a  means  of  determining  the  possibility  of  applying  a 
risk-based  intelligenee  driven  international  air  eargo  sereening  protocol  to  the  transport  of 
international  air  eargo  to  help  seeure  the  aviation  industry  and  passengers  in  light  of  the 
sueeessful  attaek  on  air  eargo  aireraft  by  AQAP  in  November  2010.  As  a  means  of 
aeeomplishing  this  task,  an  analysis  of  the  poliees  of  the  United  States  and  the  European 
Union  was  eondueted  to  determine  the  best  poliey  and  proeess  for  seeuring  this  speeifie 
section  of  the  aviation  environment.  Numerous  program  and  polices  were  reviewed  to 
inelude  the  ISA’s  risk  based  sereening,  the  TSA  and  CBP  ACAS  pilot  program,  and  the 
European  Union’s  regulatory  approaeh  to  aviation  seeurity. 

As  a  means  of  ensuring  the  widest  dissemination  possible,  this  researeh  projeet 
did  not  inelude  the  review  of  elassified  or  sensitive  seeurity  information,  as  this  inelusion 
would  have  signifieantly  limited  the  ability  of  the  information  to  be  viewed  and  analyzed 
by  a  wider  audienee.  The  intention  of  this  projeet  was  to  advanee  the  understanding  of  the 
ehallenges  faeed  by  the  aviation  industry  and  the  regulating  ageneies  required  to  provide 
a  seeure  travel  and  transportation  environment,  as  well  as  a  base  line  for  further  researeh 
to  be  eondueted. 
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